CMM7XX

Introduction to Information Security

Session 1: Security Design Principles

James Williams

jwilliams@staff.newman.ac.uk

Learning Objectives

  • Critically evaluate the extended CIA Triad within complex systems.
  • Deconstruct and apply Saltzer and Schroeder's Principles of Security Design.
  • Compare advanced Threat Modeling methodologies (STRIDE, PASTA) for enterprise environments.
  • Analyze the paradigm shift from perimeter-based security to Zero-Trust Architecture (ZTA).

Saltzer & Schroeder's Principles (1975)

Foundational principles of secure design that remain critical in modern architectures.

  • Economy of Mechanism: Keep the design simple. Complexity breeds vulnerabilities.
  • Fail-Safe Defaults: Base access decisions on permission rather than exclusion. Default to 'deny'.
  • Complete Mediation: Every access to every object must be checked for authority.
Practical Resource: Saltzer & Schroeder: Protection of Information in Computer Systems

Saltzer & Schroeder's Principles (Continued)

  • Open Design: Security should not depend on the ignorance of attackers (Kerckhoffs's principle).
  • Separation of Privilege: Require two conditions to unlock (e.g., Multi-Factor Authentication).
  • Least Privilege: Every process/user must operate using the minimum privileges necessary.
  • Psychological Acceptability: Security mechanisms must be easy to use, or users will bypass them.
Practical Resource: Saltzer & Schroeder: Protection of Information in Computer Systems

Introduction to Task 1

In the real world, massive breaches rarely occur due to zero-day cryptography exploits. They occur because fundamental design principles are violated at scale.

We will analyze the Capital One Data Breach (2019).

An attacker exploited a misconfigured Web Application Firewall (WAF) to obtain SSRF, accessed an AWS metadata service, and stole 100M+ customer records.

Practical Resource: Saltzer & Schroeder: Protection of Information in Computer Systems

Task 1: Architecture Critique

Timing: 45 minutes

In groups of 3-4, read the provided technical summary of the Capital One breach.

  1. Identify which of Saltzer and Schroeder's design principles were violated in this architecture.
  2. Specifically address the concept of Complete Mediation and Least Privilege in the context of IAM roles assigned to the WAF.
  3. Prepare a 3-minute brief on how enforcing "Fail-Safe Defaults" could have mitigated the blast radius.
Practical Resource: Saltzer & Schroeder: Protection of Information in Computer Systems

15 Minute Break

Please return promptly for Part 2.

Part 2: Threat Modeling & ZTA

Duration: 1.5 Hours

Practical Resource: MITRE ATT&CK Framework

Advanced Threat Modeling

Systematic methodologies for identifying security threats during the design phase.

  • STRIDE (Microsoft): Developer-centric. Focuses on Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege.
  • PASTA: Risk-centric. A seven-step process aligning technical requirements with business objectives. Ideal for enterprise risk management.
  • LINDDUN: Privacy-centric. Essential for GDPR compliance and data protection by design.
Practical Resource: MITRE ATT&CK Framework

STRIDE Deep Dive

Applied to Data Flow Diagrams (DFDs) to systematically find flaws:

  • Spoofing: Can an attacker impersonate a user/system? (Mitigation: Strong Auth)
  • Tampering: Can data be modified in transit or at rest? (Mitigation: Integrity/Signatures)
  • Repudiation: Can someone deny an action? (Mitigation: Auditing/Logging)
  • Information Disclosure: Is sensitive data exposed? (Mitigation: Encryption/ACLs)
  • Denial of Service: Can the system be brought down? (Mitigation: Filtering/Quotas)
  • Elevation of Privilege: Can an unprivileged user gain admin rights? (Mitigation: Least Privilege)
Practical Resource: Microsoft Threat Modeling Tool

The Zero-Trust Architecture (ZTA)

"Never Trust, Always Verify"

The perimeter model (Castle-and-Moat) is obsolete due to cloud, BYOD, and remote work.

Core Tenets (NIST SP 800-207):

  • All communication is secured regardless of network location.
  • Access to enterprise resources is granted on a per-session basis.
  • Access is determined by dynamic policy (client identity, application, asset state).
Practical Resource: NIST SP 800-207: Zero Trust Architecture

Introduction to Task 2

Threat modeling requires understanding the architecture, identifying trust boundaries, and applying a framework like STRIDE to discover potential vulnerabilities before writing a single line of code.

You have been provided with a DFD (Data Flow Diagram) for a proposed cloud-based healthcare portal.
Practical Resource: MITRE ATT&CK Framework

Task 2: Applied Threat Modeling

Timing: 50 minutes

Using the provided Healthcare Portal DFD:

  1. Identify the primary Trust Boundaries in the architecture.
  2. Perform a STRIDE analysis on the interaction between the Mobile Client and the API Gateway.
  3. Identify at least two specific threats (e.g., Information Disclosure via interception).
  4. Propose a ZTA-aligned mitigation for each identified threat.

Submit your threat matrix to the VLE at the end of the session.

Practical Resource: MITRE ATT&CK Framework

Summary & Next Steps

  • Security design must be proactive (Threat Modeling) rather than reactive.
  • Principles like Least Privilege and Complete Mediation form the basis of modern Zero-Trust Architectures.
Next Week: Introduction to Cryptography & Security Mechanisms

Please review modular arithmetic and prime factorization before the next session.

Practical Resource: MITRE ATT&CK Framework