Spring 2023 Hackathon
Prompt
You’re a consultant of a boutique security consulting firm. Your client, a software company that creates one of the top rideshare services in the world, came to you for guidance to address the rising concerns over the security and privacy of their app. You’re tasked with delivering a threat model that helps increase the security and privacy postures of their app.
Please see the details of the rideshare app that you will create a threat model for: Spring 2023 Hackathon Use Case.
Deliverable
There are two parts to the deliverable: a threat model document and a retrospective. Both parts need to be included in your final deliverable. You can present the deliverable in any format of your choice (ppt, pdf, etc).
Part 1: A threat model document
- What are you working on: Describe what the rideshare app does and its feature list, and insert a data flow diagram for the app (See resource package for suggested tools for generating data flow diagram).
-
What can go wrong: Consider the point of view of an attacker - what are the attackers’ intentions and objectives? And then use any threat modeling framework (or not!) to identify a list of threats. Finally, use any prioritization framework (or not!) to identify the top three threats to focus on.
-
What are you going to do about it: Identify solutions (also called countermeasures/mitigation) for the threats and describe how you will implement the solutions for the top three threats you prioritized.
-
Did you do a good job: Assess how the process works for you by reflecting on the questions:
-
Were you able to create a model you were satisfied with? Did you have the right resources?
-
Were you able to find some threats? Did you find more, the same, or fewer than you expected to find? What would you do differently in your next iteration to improve your threat model and find more threats?
-
How many solutions (countermeasures/mitigation) did you identify?
-
How did the threat prioritization go? How did you come down to the top three threats? What were some of the tradeoffs?
-
How feasible is your implementation plan for the solutions? Are there additional resources/skills/knowledge you need to implement your plan?
-
Part 2: Retrospective
Explain your thought process and your selection of both thinking tools and software tools that you used for creating the threat model document.
Note: What’s considered a threat?
A “threat” has some, non-zero possibility for successful exploitation of some condition. A successful threat will deliver attacker advantage, i.e., a threat is an exploitation of a “weakness or vulnerability”.
A threat must be distinguished from human actors who have an interest in compromising software (attackers, threat actors, adversaries) and from weaknesses in software that allow attackers to misuse software. A “threat” then must consist of several conditions (see below).
“Threats” consist of:
-
An adversary known to be active and exploiting systems of this type for some attacker purpose, sometimes referred to as a “Threat Actor” or adversary
-
The adversary must have sufficient capabilities, “tactics, techniques, and processes” (TTP) to exploit a weakness
-
The adversary must have some means to access a weakness. (This may involve setup, reconnaissance, successful preliminary exploitations, etc., “TTP”. That is, a weakness (exploitable condition) must be “exposed” to the adversary through some means
Because the completion of an attacker’s goals may involve multiple exploitations into a “kill chain”, a single, isolated threat in some cases may be insufficient. An alternate, more inclusive term for “threat” is “attack scenario”, denoting multiple exploitation steps from initial access through successful compromise.
Importantly, a threat is not equivalent to a weakness by itself. The majority of reported vulnerabilities are never misused by attackers. A threat implies that there is a non-zero chance for a real-world attacker to actually misuse a system in some manner not intended by the system’s stakeholders.
Submission
All deliverables must be submitted by March 19, 2023 11:59pm following the steps below:
Step 1: Upload the file to your team’s Google Drive. Name your file in the following format: Threat Modeling Connect Spring 2023 Hackathon_ Your Team ID
Step 2: Send an email to hello@threatmodelingconnect.com titled: “Threat Modeling Connect 2023 Hackathon_Submission_Your Team ID” and include:
- A link to your file in the Google drive
- Names of the individuals, agreed upon by all participating members of your team, considered inactive in completing the hackathon
Judging Criteria
Find who are on the judging panel and what the judging criteria are here.
Resources
- Check out the resource package for articles, guides, and suggested tools for building your threat models.
- Take advantage of the two checkpoints (March 8, March 15) to share your work and get feedback from mentors.