Group PowerPoint Residency - Day 2 Residency Assignment

Week 13 - Residency

Spring 2020

Group 3

002835518 - Chalamalasetty, Srinivas

002826551 - Ganji, Umakumar

002849521 - Karra, Ravi Sastry

002838332 - Kukkala, Indrakaran Reddy

002826761 - Malineni, Srinivas

002837463 - Namburu, Krishna Chaitanya Chowdary

University of the Cumberlands

Website system

The security threat identification for a university based library system is considerably significant under the minimal knowledge of danger it could pose. However, it is brought to our attention that the university library website systems have really a good threat model.

Nevertheless, the library management and the administrator have carefully analyzed the library website system and made a unrealistic assumptions with respect to what are the components that align with the access of the webpage for both send request and received response. The components include both the Graphical User interface that allows user to login or create account and access the books and other material from the library database system. The work to make a threat model has directed us to make assumptions that could either be developed or cannot be developed. Based on the assumptions prepared on threat model for the library website system helped us in understanding and the stimulated upgrades required for improving the security of those components (Shostack, 2014).

STRIDE and its associated derivations

The properties of the STRIDE threats would be generally to see if a system has the assets that are involved before building and accessing a library website system, like proper authentication and authorization to respective roles and availability of the resources like books and other materials. STRIDE signifies the properties of Spoofing, tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege (Montana State University, n.d.).

Threat	Property	Threat	Mitigation strategy
Spoofing	Modify a link	Occurs for link check and link access.	Leverage the server path
	Assign any role	Create a fake account	Identification and authentication
Tampering	Modify files on server	External files on private server domain	Use directory from arbitrary protection
	Modify data over network	External file access through wifi	Cryptography
Repudiation	Clicked the link	Directed to the page that looks almost like original webpage	Protect the logs
	Clicked the link and got response	Downloads a file onto your system	Specify rubrics to logs
Information disclosure	Throws error message with user details	No rules to the database tables with senstive information	Encryption
Denial of service	Multiple requests sent	Slows down the server system	Maintain usable resources
Elevation of privilege	Inappropriate read/write access to a user	Corrupts the information display to user	Incorporate tools to maintain and authenticate data flow

The above STIDE properties apply to the user scenarios depending on the external factors the library website system can have impacting the following servers (Montana State University, n.d.),

User scenarios	External dependencies
Students can search the database	Web server
Staff can search the database	Database server

Database system

The university library database system has been expecting that these links between the Graphical User Interface of the website and the database of the library resources should be posted and administered on a reliable network system. Under the security circumstance it is needed by the admin user to maintain the performance and the accessibility of resources accurately. The operating system, encryption and decryption of the user information helps to secure the components of both the website and database system (Shostack, 2014).

By limiting the set of connections with controlled permissions either run through in-network or out-network of campus it would address the trusted data stores and network to control the access of information. The respective assets and roles would mitigate the threats when structured as per standard IT rules (Montana State University, n.d.).

Asset	Role	Role description
Website system	guest user	the guest user can access the database but cannot perform any action
Database system	unknown user	the user is not available in the system
Database system	User	user is authenticated as student
Database system	Staff	user is authenticated as staff
Website and Database system	admin	user is authenticated as administrator with full read and write privileges

References

Shostack, A. (2014). Threat Modeling Designing for Security. pp 14-21, 62-74

Montana State University. (n.d.).CSCI – Threat Modeling. Retrieved from: https://www.cs.montana.edu/courses/csci476/topics/threat_modeling.pdf