Ways to See the Threat Before it Happens

Ways to See the Threat Before it Happens - Circuit Magazine -

source: https://circuit-magazine.com/ways-to-see-the-threat-before-it-happens/

For those who have been reading a while, you may know that this is the sixth article in this series which I originally planned to give a year’s worth of topics.

I hope you have found these articles interesting, relevant, and useful (if you have, please let the great team at Circuit Magazine know). If there are also any other topics in cyber you would like to see covered, please let them know as well.

This article focuses on threat modelling. Threat modelling is widely in use, whether knowingly or not, across every walk of life – and has been used since time immemorial to prioritise security defences. The only difference between the well-known risk assessments carried out by everyone and threat modelling in cyber security is the attempt to document and systemise it. I am hoping that this idea of formal threat modelling will be a useful tool for you to use in your future arsenal of available resources as a CP operator.

Seeing the Trees for the Forest The first, and in some ways simplest, method brought into cyber security is the idea of attack trees, or threat trees. Independently developed by Edward Amoroso and a collaboration between the NSA and DARPA, the approach is goal-oriented and works backwards. The downside is that it runs the danger of being overly focused on one particular attack motivation, or having to repeat the exercise many times. But it can’t be beat as a quick and effective approach where you are trying to prevent attackers from reaching a single target.

With an attack tree you begin with the goal of the threat. An an example, we can take the goal of getting backstage at a concert for an enthusiastic fan. Then we work backwards on what would enable them to do this, the requirements to get to that point, and so on. Below is a simple example of a worked tree, and the next stage would be to put mitigations in place to prevent those sub-goals (for example, locking the staff entrance, alarming the fire escape, requiring photo ID for VIP fans, etc).

<Attack Tree.png> Attack trees are one of the most open threat modelling techniques and the most broadly applicable. Some of the others, such as STRIDE which I will cover below, are focused on technological threats.

Personae non Grata (PnG) A second fairly open approach looks at all potential threats from the point of view of a motivated attacker. In this instance, both the goal and the means are undefined initially and instead we build a fictional hostile (or in some cases non-hostile but negligent) threat actor. These profiles can consist of anything from detailed dossiers with life histories and capability assessments, down to a few short sentences. Taking the same example as with attack trees, we would build the enthusiastic fan’s profile, and then work out what goals they might try to achieve and how.

As a standalone exercise the PnG approach is not much use – but when combined with another model such as attack trees it narrows the options and limits the choices when brainstorming. This means it can add significant value and help with more comprehensive, thoughtful threat modelling. With the attack tree shown earlier, the profile might help to expand or narrow possibilities (in this case, having previously worked at the stadium a higher weighting might be given to attacks around impersonation or stealth, and some of the existing security measures could be assumed to be compromised). Of course, such profiles do not need to be fictional where a known threat can be fed into the model instead.

An example of a simple profile which might apply to the situation being modelled above is “A Fan is a huge fan of Boys ‘R’ Us, and was recently fired from their job at Concert Stadium after trying to fraudulently order VIP tickets to an upcoming concert. They still have several good friends who work at the stadium, and have not yet returned their access badge or work uniform. While working at Concert Stadium they had long hair, but have recently had it cut and dyed and their new hairstyle/appearance is unknown.” They can be much more extensive, and often include pictures and other materials to help those running through the threat model understand motivations and capabilities.

STRIDE While STRIDE is a technical threat model designed for software development, some of the techniques involved are invaluable for any form of threat modelling to help you see the threats before it happens.

The name comes from an acronym for six attack vectors considered common in software engineering:

Spoofing Tampering Repudiation Information disclosure Denial of service Escalation of privilege

Microsoft, who developed the system, no longer strictly apply STRIDE. Other variations have been developed such as STRIPED (which reshuffles the acronym to cram Privacy in). It is widely recognised that the categories overlap and are highly subjective. Despite this, the methods used to apply those categories are still ones I consider among the most useful for any form of formal threat modelling.

To apply STRIDE, we start with a dataflow diagram – an abstraction of a software system which focuses on the way information flows through and around rather than technical detail. We then add trust boundaries, arbitrary lines designating areas of greater or lesser trust. They cannot pass through the ‘blocks’ of the system, and must form boundaries around them – the boundaries are shown in red on the attached diagram.

Once we have listed all our information flows (easier to do in IT than when dealing with people, but possible either way) and designated our boundaries, it’s a relatively simple case of highlighting every point where an information flow crosses a trust boundary. These are our vulnerabilities, or attack points. When applying to technology we take each one and run through the STRIDE acronym, brainstorming any relevant attacks against each. Technically infeasible attacks can be listed and then discarded later – we are simply trying to be reasonably comprehensive at this point.

Once we have enough attacks against our vulnerabilities, it becomes a case of risk management against each where we need to consider the likelihood of an attacker exploiting a particular vulnerability, and the impact of them managing. While the example here is for a simple, high-level system (a smart heating system for a house) to identify the potential attack surface rather than delve into vulnerabilities, the STRIDE methodology can be a general approach that can be adapted for very complex systems as well as non-technical, physical environments. <STRIDE.png>

These threat modelling techniques are most effective when they are tailored to the system being considered, and can draw appropriate techniques from any source where they are useful. It also gains more value the more effort is put into it. The examples provided are very quick, simplified threats to purely to illustrate the techniques. At the very least, they will provide a few nuggets of information that you may find useful in your next threat assessment.

Threat Modelling – Ways to See the Threat Before it Happens By: James Bore

James Bore is a Jack of all trades in cyber security by vocation and choice. He has been speaking and writing to build awareness of cyber security for several years, and now provides consultancy to companies looking to mature their own security to better protect their customers and employees. His hobbies include lockpicking, beekeeping, and homebrewing and in occasional spare time he maintains a blog at https://coffeefueled.org.

The post Ways to See the Threat Before it Happens appeared first on Circuit Magazine.

Tactical Firearms Training – The Basics

If you plan on working internationally in the close protection or security industry you will be expected to some degree to know how to handle firearms. Now, to get things straight to start with, what most people, especially Americans, don’t realize is that most non-government close protection jobs are unarmed due to the legal restrictions on firearms in most countries. Part of your threat assessment for any assignment needs to include the laws on the use of force and what if any weapons are legal in the locations you are going to be working in. Being caught with an illegal weapon, especially a firearm will get you thrown in jail very quickly, no matter how important you think you are! So, what do you need to know about firearms if you are looking to work internationally in the close protection and security industry, well the first and most important thing is knowing how to use firearms safely. To become proficient with firearms, like everything else takes practice and time, you’re not going to become and expert after a few hours’ tuition. Many firearms related accidents happen because those handing the firearms are not complying with the basic firearms safety rules of keep the firearms pointed in a safe direction and keeping their fingers off the guns trigger. If you ensure you always follow these two safety rules, you will be acting more responsibly than many others who are working with and carrying firearms. Remember, if you’re the one holding and in control of a firearm that accidentally discharges and injures or kills someone you will be held responsible. A thorough understanding of firearms and range safety is essential before you even start any shooting with live ammunition. Here is a more complete list of firearms safety rules and considerations. WEAPON SAFETY DEPENDS ON KNOWING YOUR WEAPON, CONFIDENCE, ALERTNESS Safety considerations for firearms must always be followed Always keep firearms pointed in a safe direction, especially when loading and unloading. Keep your finger off the trigger until the weapon is pointed at your target. If the action or slide on the weapon is closed, always treat the gun as if loaded and carry out the unload drills. Always show that a firearm is unloaded to a person before you hand it to them. When someone hands you a firearm, always check the chamber and make sure it is unloaded. Never take a person’s word for whether a firearm is loaded or unloaded, always check! Never point a firearm at anyone just for fun or play games with firearms. Always know what is behind your target and have a good backstop. Only fire-controlled shots. You can rapid fire but make sure you are hitting your target. Always practice tactical drills with unloaded firearms until you’re confident and competent enough to use live ammunition. Always unload firearms before dry-fire tactical training. Only use dummy ammunition or blank-firing firearms for demonstrations or dry-fire drills. Never mix blank, dummy, and live rounds. Always check that the gun is unloaded before cleaning. Never tamper with ammunition, and only use reloads from reliable sources. Never use damaged rounds, and always dispose of them safely. Keep guns and ammunition in secure storage when not in use. If you do not know how to operate or are having problems operating a firearm, get professional help. Never used drugs or alcohol when using firearms. Always check and comply with local firearms law Types of Firearms You should try to train with and get to know as many different types of firearms as possible as you never know what you will come across. You might be working unarmed on an assignment in a hostile environment but you need to know how to use the firearms you might encounter in that environment incase things go bad, say your hotel is attacked, and you might have to use the firearms of the local security, police, military and bad guys or make them safe after an incident. Pistols: The two main classification for pistols are semi-automatic and revolver. Sadly, most people these days tend to only train with semi-auto safe action guns such as Glock and S&W M&P’s etc. You need to know how to safely use revolvers, single and double action semi-autos, single action semi-autos and at least be familiar with derringers and sub-compact pocket pistols. Shotguns: I have heard quite a few supposed close protection experts, usually from police backgrounds dismiss the requirements for shotgun training. The reason for this I believe, is in their limited experience within a government agency they have never had the opportunity to use shotguns or travel to locations where they are used. I have personally working in Europe, South & West Africa, Middle East, US, Caribbean, Latin America and have come across shotguns being used in for security details in all of those locations. I would say shotguns are the most widely used firearm used for legal security purposes globally. Shotguns come in various configurations and you should at least understand break action, pump, semi-auto shotguns and the various types of ammunition and chocks. Assault Rifles: Even though most of the tacticool firearms training videos on the internet put an emphasis of training with AR-15’s and AK-47’s in reality there are not many places you can legally use them for security purposes unless you are in the military, on a government related assignment or working illegally. In Iraq and Afghanistan, the laws were put in place for security guards to carry assault rifles, but in most places if you are lucky enough to legally have firearms there is a greater change of it being a shotgun or a pistol rather than an AK etc. Sporting Rifles: In a lot of countries semi-auto firearms are banned or very restricted and the only legal firearms available will be sporting shotguns and leaver or bolt-action rifles. The only time most tacticool operators will consider learning how to use a bolt-action rifle would be if it was a tricked-out sniper rifle… Well, I am sorry if I offend any tacticool operators reading this but all hunting rifles, even with wood stocks, can be used as sniper rifles and for tactical applications. If someone is trained how to shoot properly, understands individual tactics and is armed with a decent leaver or bolt action .22 rifle, I would class them as far more value than the tacticool shemagh wearing operator who uses optics on their tricked-out AR-15 to hit paper targets at 15 meters… Other Firearms: Depending on where you are planning to work depends on the types of firearms you could encounter; in hostile environments you may need to have the rudimentary knowledge of how to operate belt-fed machine guns. Or, if you’re in an area where hunting is popular it might make sense to learn a little bit about black powder rifles and pistols, which in some places have a lot less restrictions on them than cartridge firing firearms. Tactical Firearms Training I have my own views of firearms training and the state of the firearms training industry but will try to keep them to myself as much as I can for the sake of this article. My basic advice to anyone looking at attending any firearms training courses would be is the course relevant and is the instructor experienced enough to teach it. The best place to get a good grounding in firearms training is in the military as you should be given thorough training, the bullets will be free, and you will also be getting paid for your time. There is no way you can replicate a few years military firearms training experience by taking a two-week tactical firearms course. One issues with those who have only had regular military training is that they are only used to dealing with a limited range of firearms. Personally, I only really started to learn and use handguns other than a Browning Hi-Power after I left the British Army and worked in South Africa, Eastern Europe and then joined a gun club in UK before handguns were banned. You must ensure the training you will be getting is relevant for what your going to be doing and is of a good standard. In the U.S. the general standard for training is what’s put out by the National Rifle Association (NRA). Most people don’t realize when taking a training course from an NRA instructor that it only takes one-day to become and NRA instructor or Range Safety officer. In the United States, it’s easy for a novice shooter to become an NRA firearms instructor, as I said it’s a one-day course, SERIOUSLY! With another one-day course they can become a Range Safety Officer, and after that with another one-day course a Chief Range Safety Officer able to certify Range Safety Officers… All without any experience of ever running a firearms course or any experience of actually working on a shooting range… I have come across NRA instructors who could not field strip their own firearms, Chief Range Safety Officers who had never used revolvers or shotguns. From their certifications you would expect them to be experienced professionals! Well, think again… You cannot gain the experience required to be a decent RSO or instructor by just attending a few theory classes, watch tacticool YouTube videos and belonging to Gung-ho online chat forums. The schools issuing these NRA certifications are making money, it’s business, but how many of their students then go on to market themselves as “firearms experts” after just a few one-day classes? I think this can be classed as fraudulent in anyone’s books. It’s just like taking a first-time driver, giving them a two- or three-day theory on how to drive, showing them a car, starting the engine and then certifying them to set up a driving school… Scary, right? Always verify the real-world experience of the instructors who you’re intending to pay good money for quality training. Firearms training can be very expensive so ensure you’re not wasting your money and understand that after just a few days training you’re not going to be at a professional level, whatever your certificates say! Ongoing dry and live firearms training and weapons familiarization is essential if your serious about working in hostile environments but learn to differentiate the difference between tacticool holidays and experiences and relevant training! Tactical Firearms Training – The Basics The post Tactical Firearms Training – The Basics appeared first on Circuit Magazine.

Why Consider A Career in Executive Protection? - Circuit Magazine -

Newcomers Corner, Why Consider A Career in Executive Protection? written by Harlan Austin for issue 54 of the Circuit Magazine

Weaponising Social Media - Circuit Magazine -

James Bore looks at Weaponising Social Media, conspiracy theories and opportunistic misinformation is misused taken from Issue 54 of the Circuit Magazine

Trunk Guns - Circuit Magazine -

One of the biggest ongoing phenomena is the firearms space is the concept of a trunk gun. Whether it is a handgun, shotgun, or a rifle, firearms are simply tools. When it comes to any tool, you first must ask what is your objective? Let's begin by considering the history or evolution of this phenomenon.

The Importance of Emotional Control in the Workplace - Circuit Magazine -

Denida Zinxhiria Grow looks at The Importance of Emotional Control in the Workplace, a Guide for Executive Protection Operatives from issue 54

Tactical Firearms Training – The Basics

Why Consider A Career in Executive Protection? - Circuit Magazine -

Weaponising Social Media - Circuit Magazine -

Trunk Guns - Circuit Magazine -

The Importance of Emotional Control in the Workplace - Circuit Magazine -

Circuit Magazine

Categories

Social Footprints