This article is the first part of our three-part series about security.
Read the second part on email spoofing, trusted sources and cross-site scripting or read about iframes and certificate pinning in part 3.
Online security has many aspects. One of those aspects is social. We teach internet users not to click on suspicious links. We maintain communities by weeding out the bad apples, creating a safe environment that way. Another aspect is how a user experiences the website. A messy-looking website, or a website where messages or blocks are clearly broken, lowers a user’s trust in that site. This means, for example, that people are less inclined to register an account, or to place an order.
Although these are also interesting topics to discuss, this article is more about the technical aspects of creating a secure website. In this three-part blog we will briefly discuss how you determine what measures are needed or wanted, and highlight a few technical security measures.
THREAT MODEL
You do not take most security measures just because you can, but because they protect against a specific danger.
The Netherlands, for example, has a large number of dikes, flood defences and floodplains. These protect low-lying areas and areas next to rivers against flooding. Without such protection, a town or area would regularly end up under water. A dike, however, is only effective when it holds back water. If you live on a mountain 1km high, a flood barrier to hold back the sea is not useful. The flood barrier is still capable of holding back the sea, but in practice it is highly unlikely that the sea will ever reach that spot.
At airports we have checkpoints where we stop people who want to bring bombs and/or slightly too large bottles of shampoo onto the plane. To achieve this, an airport has all kinds of systems that make sure people cannot reach a plane without passing through certain checkpoints. An airport is reasonably effective at this. You will not usually find the same kind of systems in someone’s home, although we would also rather not have someone walk in with a too large bottle of shampoo bomb. Why not? It is unlikely to happen, and the measures you would need to take to prevent it do not outweigh the benefits.
The same is true for a website, web app or even a company. To determine what security measures are needed or useful, it is important to think about what dangers exist, what risk each danger poses and whether security measures outweigh that risk. This is called a threat model.
A threat model can be set up in all kinds of ways. Sometimes this is done using a diagram like the one shown below, sometimes with a simple table and sometimes with a flow diagram that shows where dangers exist within an application. The purpose of all these approaches is to map out likely and unlikely dangers, and to determine what protection is needed for each or what risk is acceptable.
Has your organisation changed recently? Does your threat model still match reality? Get in touch with us, no obligation to see what we can do for you.