The Battle for New York: A Case Study of Applied Digital Threat Modeling at the Enterprise Level
The Battle for New York: A Case Study of Applied Digital Threat Modeling at the Enterprise Level
复制标题
纽约之战：企业级应用数字威胁建模案例研究
DOI：
--
复制
发表时间：
2018
期刊：
影响因子：
--
通讯作者：
Michelle L. Mazurek
中科院分区：
文献类型：
--
作者：
Rock Stevens;Daniel Votipka;Elissa M. Redmiles;Colin Ahern;P. Sweeney;Michelle L. Mazurek
数字安全专业人员使用威胁建模来评估和改善组织或产品的安全状况。然而，没有威胁建模技术已在现实世界中，企业环境进行了系统的评估。在本案例研究中，我们将正式的威胁建模引入纽约市网络司令部：美国人口最多的城市的主要数字防御组织。我们发现威胁建模可以提高自我效能; 25名参与者中有20人在培训30天后定期将其纳入日常职责中，无需进一步提示。120天后，实施参与者设计的威胁缓解策略为纽约市提供了切实的安全利益，包括阻止541次独特的入侵尝试，防止劫持5个特权用户帐户，并解决了3个面向公众的服务器漏洞。总的来说，这些结果表明，引入威胁建模可以在企业环境中提供有价值的好处。
Digital security professionals use threat modeling to assess and improve the security posture of an organization or product. However, no threat-modeling techniques have been systematically evaluated in a real-world, enterprise environment. In this case study, we introduce formalized threat modeling to New York City Cyber Command: the primary digital defense organization for the most populous city in the United States. We find that threat modeling improved self-efficacy; 20 of 25 participants regularly incorporated it within their daily duties 30 days after training, without further prompting. After 120 days, implemented participantdesigned threat mitigation strategies provided tangible security benefits for NYC, including blocking 541 unique intrusion attempts, preventing the hijacking of five privileged user accounts, and addressing three public-facing server vulnerabilities. Overall, these results suggest that the introduction of threat modeling can provide valuable benefits in an enterprise setting.