Linux Server Security (2nd Edition( [Electronic resources] نسخه متنی

Chapter 1. Threat Modeling and Risk Management

Since this book is about building secure Linux Internet servers from
the ground up, you're probably expecting
system-hardening procedures, guidelines for configuring applications
securely, and other very specific and low-level information. And
indeed, subsequent chapters contain a great deal of this.

But what, really, are we hardening against? The answer to that
question is different from system to system and network to network,
and in all cases, it changes over time. It's also
more complicated than most people realize. In short, threat analysis
is a moving target.

Far from a reason to avoid the question altogether, this means that
threat modeling is an absolutely
essential first step (a recurring step, actually) in securing a
system or a network. Most people acknowledge that a sufficiently
skilled and determined attacker^[1] can compromise almost any system,
even if you've carefully considered and planned
against likely attack vectors. It therefore follows that if you
don't plan for even the most
plausible and likely threats to a given system's
security, that system will be particularly
vulnerable.

^[1] As an abstraction,
the "sufficiently determined
attacker" (someone theoretically able to compromise
any system on any network, outrun bullets, etc.) has a special place
in the imaginations and nightmares of security professionals. On the
one hand, in practice such people are rare: just like
"physical world" criminals, many if
not most people who risk the legal and social consequences of
committing electronic crimes are fairly predictable. The most likely
attackers therefore tend to be relatively easy to keep out. On the
other hand, if you are targeted by a skilled and
highly motivated attacker, especially one with
"insider" knowledge or access, your
only hope is to have prepared for the worst, and not just the most
likely threats.

This chapter offers some simple methods for threat modeling and
risk management, with
real-life examples of many common threats and their consequences. The
techniques covered should give enough detail about evaluating
security risks to lend context, focus, and the proper air of urgency
to the tools and techniques the rest of the book covers. At the very
least, I hope it will help you to think about network security
threats in a logical and organized way.