page1
F9: An undetected stolen or lost PKI certificate may enable the attacker to connect to the confidential network up to the moment his activity is detected via the log analysis, user reporting or network intrusion detection and the certificate is put on the CRL.
F11: An unpatched vulnerability or zero day exploit in the VPN server may give an attacker access to the network up to the moment the traffic is detected by the intrusion detection.
R13:An attacker can attack or brute force the VPN admin interface or use an unpatched vulerability in the VPN service or admin interface..
F10: If the firewall is misconfigured and the network intrusion detection does not detect the unusual network traffic an attacker may gain access to the confidential network.
F6: The company laptop is unusable if data exchange via external media is required.
F5: An external SATA harddisk can be used by an insider to leak sensitive information via the company laptop.
F3: The laptop cannot be used for communication with any other networks.
F4: A misconfiguration on the laptop or a remote exploit may give an attacker access to the data on the laptop.
F1: An attacker with supercomputing resources may brute force the encryption, data integrity and confidentiality is at risk.
F2: A denial of service attack may make the network unavailable for all users that connect over the internet.
R7: External media connected to the company laptop can be used by an insider to leak sensitive data
R2: The company laptop can be used by an insider to leak sensitive information.
R1: If the firewall is misconfigured an insider may still leak information to the internet.
R5: The VPN server is attacked as stepping stone to the network.
R4: A stolen or lost PKI certificate may enable an attacker to connect to the confidential network.
R3: A remote exploitable vulnerability on the laptop may give an attacker access to the network when the VPN is connected.
R8: A misconfiguration on the laptop or a remote exploit may convert the laptop into a stepping stone for the attacker to attack the network.
R11: A misconfiguration on the laptop or a remote exploit may convert the laptop into a stepping stone for the attacker to attack the network unless this is detected as unusual VPN activity.
R12: An undetected stolen or lost PKI certificate may enable the attacker to connect to the confidential network up to the moment his activity is detected and the certificate is put on the CRL.
R9: An undetected stolen or lost PKI certificate may enable the attacker to connect to the confidential network for max. 1 year.
Example Risk Reduction Overview:
Giving users access to a network with sensitive data over the internet.
This example is purely hypothetical and does not reflect an existing design.
M2: A company laptop equipped with VPN software is required to gain access to the network. The IPSec VPN uses RSA authentication which requires a 2048 bit PKI certificate stored on the harddrive. The VPN uses AES256 encryption.
M3: A host-based firewall is active on the company laptop, preventing any other network traffic except encrypted VPN traffic.
M4: Full disk encryption with strong passwords are used on the company laptop.
M7: Local port control policies prevent reading and writing to external media such as CD-ROM, DVD or USB disks.
M5: The PKI certificates are valid for 1 year, and if there is any doubt if a certificate was copied it is placed on a revocation list which is used by the VPN server.
M6: A hardened Linux service is used to host the VPN server. No other services are exposed to the external network, and SELinux is enabled in enforcing mode. The server is monitored 24x7.
I1: An inside user leaks sensitive data from the network to the internet. Data confidentiality is at risk.
I2: An attacker intercepts the communication between user and network. Data integrity, confidentiality and availability is at risk.
I3: An attacker connects to the confidential network. Data integrity, confidentiality and availability is at risk.
I4: An attacker starts a denial of service attack targeted at the confidential network.
R6: A misconfiguration of the firewall may leave the network open for attack.
R10: An unpatched vulnerability or zero day exploit in the VPN server may still give an attacker access to the network.
F7: If the firewall is misconfigured and the network intrusion detection does not detect the unusual network traffic an insider may leak sensitive information to the internet.
F8: A mis-configured laptop or remote exploit on the laptop may enable the attacker to attack the network as long as both intrusion detection systems do not detect any unusual activity
M9: Network intrusion detection is installed behind the VPN server to look for anomalies in the network traffic. The network intrusion detection is watched 24x7.
M8: VPN activity is reported to the end-user and VPN log files are analyzed for anomalies.
M1: A statefull firewall blocks all inbound and outbound traffic, except inbound traffic to the VPN gateway.
M10: Administration is done over an aes-256 encrypted ssh connection and requires both a private key and a password. The ssh interface can only be accessed from the inside network.
R14: A misconfiguration on the laptop or a remote exploit which are not detected by the host based intrusion detection may convert the laptop into a stepping stone for the attacker to attack the network until this is detected as unusual VPN activity.
M11:Host-based intrusion detection software runs on the laptop and shuts down all network access on alarms
F12:On false positives from the host-based intrusion detection the laptop cannot be fixed over the line but needs to be brought in physically