A Survey on Threat-Modeling Techniques: Protected Objects and Classification of Threats

Abstract

Information security is one of the most important attributes of distributed systems that often operate on unreliable networks. Enabling security features during the development of a distributed system requires the careful analysis of potential attacks or threats in different contexts, a process often referred to as «threat modeling». Information protection should be comprehensive, but it is also necessary to take into account the possibility of the emergence of threats specific to a certain information system. Many public and private organizations are still trying to implement system models and the threats directed at them on their own. The main reason for this is the lack of useful and high-quality methodologies that can help developers design system models. This review explores a variety of the literature on confidentiality- and integrity-aware system design methodologies, as well as threat classification methods, and identifies key issues that may be referenced by organizations to make design system processes easier. In particular, this article takes a look at the extent to which existing methodologies cover objects of protection and methods of classifying threats, as well as whether there are such models of systems in which the object itself and the threats directed at it are described. This includes whether the compiled models exhibit symmetry or asymmetry. This literature research shows that methodologies appear to be heterogeneous and versatile, since existing methodologies often only focus on one object of protection (a system). Based on the given analysis, it can be concluded that the existing methodologies only relate superficially to the description of system models and threats, and it is necessary to develop a more complete abstract model of the protected object and threats aimed at it in order to make this model suitable for any organization and protect it against most threats.

Formation of Vulnerable Node «adobe Coldfusion Deserialization of Untrusted Data Vulnerability»

“…В работах [4,5] Не менее важным аспектом становится описание и моделирование узлов и сетей, подверженных уязвимостям, а также соответствующих атак. Методам и нотациям формального описания компьютерных атак посвящено немалое количество научных работ [9][10][11][12][13][14]. В работах [10,11] объясняется важность выбора правильной методологии для описания угроз информационным системам, в работах [12][13][14] предлагаются различные подходы к описанию угроз кибербезопасности.…”

“…Методам и нотациям формального описания компьютерных атак посвящено немалое количество научных работ [9][10][11][12][13][14]. В работах [10,11] объясняется важность выбора правильной методологии для описания угроз информационным системам, в работах [12][13][14] предлагаются различные подходы к описанию угроз кибербезопасности. Предложенные подходы сравниваются в статье [9], в заключении которой упоминается удобство использования MAL для описания сценариев кибератак.…”

A Hybrid Perspective on Threat Analysis and Activity-Based Attack Modeling for Strengthening Access Control in IoT

“…Over the past ten years, there has been an exceptional increase in the number of Internet of Things (IoT) devices, which include a wide range of products such as smart home appliances and industrial sensors. The rapid increase in the number of connected devices is fueled by technological advancements, which allow ordinary objects to establish internet connections, exchange information, and seamlessly communicate with one another [1], [2]. The widespread adoption of IoT has resulted in a notable rise in device connectivity, which in turn has led to the generation of immense volumes of data.…”

WebGuardian: Holistic Approach to Address Dynamic Web Application Threat Landscape

“…This research reveals a notable shortage of vulnerability information sources, especially concerning the severity of identified vulnerabilities. Addition to that this research introduces a novel method for calculating risks, incorporating both the impact and financial aspects [4], which increase the accuracy of risk assessments. Ultimately this research paper outlines the importance of creating a comprehensive yet userfriendly security solution for web applications that remains affordable for any organization.…”