Session 02 - Threat Modeling

Tại Sao Cần Threat Modeling?

Threat modeling là quá trình có hệ thống để xác định, đánh giá và xử lý security threats trước khi code. Chi phí fix security bug tăng 30-100x nếu phát hiện ở production so với design phase.

Khi nào thực hiện?

STRIDE Methodology

Microsoft STRIDE phân loại threats thành 6 categories:

Data Flow Diagram cho .NET App

Level 0 - Context Diagram

Level 1 - Trust Boundaries

TB = Trust Boundary: Mỗi khi data cross boundary, cần validation và authentication.

Threat Modeling Workshop Process

Step-by-Step (90 phút workshop)

Risk Assessment Matrix

Participants

• Required: Tech Lead, Senior Developer, Security Champion
• Optional: Product Owner, DevOps, QA
• Facilitator: Người hiểu threat modeling methodology

Example: Threat Model cho .NET Web API

System: Order Management API

Components: ASP.NET API → SQL Server → Azure Service Bus → Worker

STRIDE Analysis

Mitigation Implementation

csharp
// Threat: Info Disclosure - Stack trace in production
// Mitigation: Custom exception handler
app.UseExceptionHandler(errorApp =>
{
    errorApp.Run(async context =>
    {
        context.Response.StatusCode = 500;
        context.Response.ContentType = "application/json";

        var errorFeature = context.Features.Get<IExceptionHandlerFeature>();
        var logger = context.RequestServices.GetRequiredService<ILogger<Program>>();

        // Log full exception internally
        logger.LogError(errorFeature?.Error,
            "Unhandled exception for {Path}", context.Request.Path);

        // Return sanitized response to client
        await context.Response.WriteAsJsonAsync(new
        {
            error = "An internal error occurred",
            traceId = Activity.Current?.TraceId.ToString()
        });
    });
});

// Threat: Elevation of Privilege - Admin endpoint access
// Mitigation: Policy-based authorization
builder.Services.AddAuthorizationBuilder()
    .AddPolicy("AdminOnly", policy =>
        policy.RequireRole("Admin")
              .RequireClaim("department", "engineering"))
    .AddPolicy("OrderWrite", policy =>
        policy.RequireAuthenticatedUser()
              .AddRequirements(new OrderOwnerRequirement()));

Microsoft Threat Modeling Tool

Khi nào dùng tool vs manual?

Output Format

Threat model document nên chứa:

1. System description và scope
2. DFD diagrams với trust boundaries
3. Threat list với STRIDE classification
4. Risk ratings (Impact x Likelihood)
5. Mitigations với implementation status
6. Assumptions và out-of-scope items
7. Review date cho periodic reassessment

Trade-offs