Attachments: CST 620 Project 3 Mobile Application Threat Modeling.docx [ Preview Here ]
Threat modeling begins with a clear understanding of the system in question. There are several areas to consider when trying to understand possible threats to an application: the mobile application structure, the data, identifying threat agents and methods of attack, and controls to prevent attacks. With those aspects in mind, you can create a threat model, which consists of an outline or checklist of items that need to be documented, reviewed, and discussed when developing a mobile application.
ASSIGNMENT [MUSIC PLAYING]
You are a cyber threat analyst at a mobile applications company. One morning, your supervisor, Dan, tells you about a mobile application security project that is already underway, but needs more guidance. Because of your success on previous projects, he wants your help.
Your expertise and oversight will enable the mobile app team to meet its approaching deadline. “Mobile applications and their security are on the technology roadmap for our organization. Of course, this means we need to be well-informed of mobile application security management.”, Dan says.
“Without the proper threat modeling, leadership can’t be sure of the issues that lie ahead. I want you to oversee the project and manage the team.” Dan says, “We’d also like you to contribute to this project by preparing a report for senior management. The report should include threat models to this technology as well as remediation for management to consider. The report should give senior management a greater understanding of mobile application security and its implementation.
Your report should consist of the following sections– mobile application architecture, mobile data, threat agent identification, methods of attack, and possible controls. The goal is to convince senior managers that your proposals will benefit the company. If you succeed, leadership will move forward with its plan for mobile applications. The report is due in two weeks.”
In this project, you will create a threat model. The length of this threat model should be eight to 10 pages. There are seven steps that will lead you through this project, beginning with the scenario as it might occur in the workplace, and then continuing with Step 1: “Describe Your Mobile Application Architecture.” Most steps of this project should take no more than two hours to complete, and the project as a whole should take no more than two weeks to complete.
When you submit your project, your work will be evaluated using the competencies listed below. You can use the list below to self-check your work before submission.
• 1.1: Organize document or presentation in a manner that promotes understanding and meets the requirements of the assignment.
• 1.2: Develop coherent paragraphs or points to be internally unified and function as part of the whole document or presentation.
• 1.3: Provide sufficient, correctly cited support that substantiates the writer’s ideas.
• 1.4: Tailor communications to the audience.
• 2.1: Identify and clearly explain the issue, question, problem under consideration.
• 2.2: Locate and access sufficient information to investigate the issue or problem.
• 2.5: Develop well-reasoned ideas, conclusions, checking against relevant criteria.
• 6.3: Specify security solutions based on knowledge of principles, procedures, & tools of data mgmt, such as modeling techniques, data backup, data recovery, data directories, data warehousing, data mining, data disposal, & data standardization processes.
Step 1: Describe Your Mobile Application Architecture
In your role as a cyber threat analyst, you will identify for senior management how a particular mobile application of your choosing conforms to mobile architectures where you are asked to describe device-specific features used by the application, wireless transmission protocols, data transmission mediums, interaction with hardware components, and other applications. You will identify the needs and requirements for application security, computing security, and device management and security. You will describe the operational environment and use cases, and identify the operating system security and enclave/computing environment security concerns, if there are any. This can be fictional or modeled after a real-world application. Be sure to use APA citation format. This will be part of your final report. To guide you in your completion of this task, click the following links and review the topics and their resources:
• network security threats
• threat modeling
• mobile architectures
• application security
• operating system security
• enclave/computing environment
Begin by first reviewing the OWASP Mobile Security Project Testing Guide.
Although mobile applications vary in function, they can be described in general as follows:
• wireless interfaces
• transmission type
• hardware interaction
• interaction with on device applications/services
• interaction with off device applications/services
• encryption protocols
In Section 1 of your research report, you are to address a number of questions as they apply to your selected mobile application. You will focus your discussion on the security threats, vulnerabilities, and mitigations of the above considerations.
The following resources will continue to educate your management about mobile devices and mobile application security: mobile platform security, mobile protocols and security, mobile security vulnerabilities, and related technologies and their security. Related technologies can include hardware and software that are needed to interoperate with mobile devices and mobile applications. Include an overview of these topics in your report.
Use Mobile Application and Architecture Considerations to review the architecture considerations for mobile applications and architecture. Then, in your report to senior management, include those that are relevant to your mobile application. Address the following questions:
1. What is the design of the architecture (network infrastructure, web services, trust boundaries, third-party APIs, etc.)?
2. What are the common hardware components?
3. What are the authentication specifics?
4. What should or shouldn’t the app do?
You will include this information in your report.
When you have completed the work for Section 1, describing the architecture for your app, move on to the next step, where you will define the requirements for the app.
Step 2: Define the Requirements for Your Mobile Application
In the previous step, you described your app’s architecture. For Step 2 and in the second section of your report, you will define what purpose the mobile app serves from a business perspective and what data the app will store, transmit, and receive. It’s also important to include a data flow diagram to determine exactly how data is handled and managed by the application. You can use fictional information or model it after a real-world application. Here are some questions to consider as you define your requirements:
• What is the business function of the app?
• What data does the application store/process (provide data flow diagram)?
o This diagram should outline network, device file system, and application data flows
o How is data transmitted between third-party APIs and app(s)?
o Will there be remote access and connectivity? Read this resource about mobile VPN security, and include any of these security issues in your report.
o Are there different data-handling requirements between different mobile platforms? (iOS/Android/Blackberry/Windows/J2ME)
o Does the app use cloud storage APIs (e.g., Dropbox, Google Drive, iCloud, Lookout) for device data backups?
o Does personal data intermingle with corporate data?
o Is there specific business logic built into the app to process data?
• What does the data give you (or an attacker) access to? Think about data at rest and data in motion as they relate to your app. Do stored credentials provide authentication? Do stored keys allow attackers to break crypto functions (data integrity)?
• Third-party data: Is it being stored and/or transmitted? What are the privacy requirements of user data? Consider, for example, a unique device identifier (UDID) or geolocation being transmitted to a third party. Are there regulatory requirements to meet specific-to-user privacy?
• How does other data on the device affect the app? Consider, for example, authentication credentials shared between apps.
• Compare the impacts of jailbroken devices (i.e., a device with hacked or bypassed digital rights software) and non-jailbroken devices. How does the differences affect app data? This can also relate to threat agent identification.
When you have defined the requirements, move to the next step, where you will identify any threats to the app’s operation.
Step 3: Identify Threats and Threat Agents
Now that you have identified the mobile app’s requirements, you will define its threats. In Section 3 of the report, you will identify possible threats to the mobile application and also identify the threat agents. Additionally, you will outline the process for defining what threats apply to your mobile application.
For an example of threat agent identification, review Threat Agent Identification Example.
For a list of threat agents, review List of Threat Agents.
After you’ve identified threats and threat agents, move to the next step, where you will consider the kinds of ways an attacker might use to reach your app’s data.
Step 4: Identify Methods of Attack
In the previous step, you identified threat agents. In this step and in Section 4 of the report, you will identify different methods an attacker can use to reach the data. This data can be sensitive information to the device or something sensitive to the app itself. Read these resources on cyberattacks and provide senior management with an understanding of the possible methods of attack of your app.
When you have identified the attack methods, move to the next step, where you will analyze threats to your app.
Step 5: Analyze Mobile Application Threats
You just learned to identify threats and methods of attacks on mobile applications. Now, apply what you have learned by analyzing sample threats using tools in the lab. Identify threat agents and ways they may try to attack your mobile application. Review any previous resource that might help you.