jasonratcliffe.dev

Threat model

My career, as a STRIDE threat model

STRIDE is how security engineers sort what can go wrong in a system. Here the “system” is an enterprise cloud estate, and each threat class is answered with controls I designed, funded or shipped. Every line is backed by my resume.

Spoofing

violates → Authentication

Can someone pretend to be a user, workload or admin?

  • MITIGATEDFederated cloud identityIAM Role federation with Okta across USAA’s multi-cloud estate.
  • MITIGATEDIdentity consolidationCentrify AD Bridging on 10,000+ Unix/Linux systems: ~35,000 local identities reduced to ~2,000.
  • MITIGATEDStrong authentication for privilegeMFA for privileged accounts via PowerBroker; hardware MFA enrolled for AWS root users.
  • MITIGATEDRogue identity cleanupTriaged Google Cloud Identity: unmanaged identities, unapproved OIDC clients, non-USAA identities.

Tampering

violates → Integrity

Can someone change code, config or data they should not?

  • MITIGATEDPreventative guardrailsService Control Policies (e.g. restrict IGW) across AWS Organizations.
  • MITIGATEDHardened baselines and drift detectionCIS baselines with Qualys Policy Compliance to reduce configuration/patching drift.
  • MITIGATEDMandatory access controlSELinux adoption for OpenShift and the 20,000+ server fleet.
  • MITIGATEDPipeline securityTwistLock vulnerability and configuration management in GitLabCI.
  • MITIGATEDMalicious content inspectionS3 malware scanning of 30M+ objects per day.

Repudiation

violates → Non-repudiation

Could someone act and later deny it?

  • MITIGATEDCentralized audit trailCentralized CloudTrail logs to S3, consumed by the on-premises SIEM.
  • MITIGATEDNetwork evidenceEnforced VPC flow logs feeding GuardDuty.
  • MITIGATEDRecorded privileged sessionsBeyondTrust PasswordSafe privileged session management.
  • MITIGATEDAsset ownershipPublic Cloud Account Metadata app used by 3,000+ developers to track who owns what.

Information disclosure

violates → Confidentiality

Can data leave where it is allowed to be?

  • MITIGATEDData perimeterVPC Endpoint Policy Orchestration, presented at AWS re:Inforce 2023.
  • MITIGATEDEncryption by sensitivityClient/server-side encryption with AWS managed or customer managed keys.
  • MITIGATEDExposure removalMonitored and removed public S3 buckets and Security Groups open to 0.0.0.0/0.
  • MITIGATEDMisconfiguration huntingTiger team remediation across 70+ GCP projects, 45+ AWS accounts, 50+ Azure subscriptions.

Denial of service

violates → Availability

Can the business keep running when something breaks?

  • MITIGATEDResilience postureAWS Resilience Hub across the AWS Organization with automated onboarding and reporting.
  • MITIGATEDResilience automationLed the AWS Resilience Automation capability within Public Cloud Security.
  • MITIGATEDContinuous monitoringPrisma Public Cloud with automated enrollment of every AWS, GCP and Azure account.

Elevation of privilege

violates → Authorization

Can someone gain more access than they were given?

  • MITIGATEDLeast privilege at scaleIAM access patterns for 450+ AWS accounts, 220+ GCP projects and 2 Azure tenants.
  • MITIGATEDKill long-lived credentialsConverted IAM Users to Roles.
  • MITIGATEDKey lifecycle managementInventoried 150,000+ SSH key pairs and removed 40,000+ unused authorizations.
  • MITIGATEDPrivilege delegationPasswordSafe for delegated elevated privileges across cloud apps and servers.

Also in the terminal: press ` and run threat-model E.

guest@jasonratcliffe: ~