To complete this assignment, review the prompt and grading rubric in the
Stepping Stone One Guidelines and Rubric PDFdocument. You will also need the
Stepping Stone One Template Word Document.
Links for articles
https://www.networkworld.com/article/2867313/lessons-from-the-sony-breach-in-risk-management-and-business-resiliency.html
http://ezproxy.snhu.edu/login?url=https://search.ebscohost.com/login.aspx?direct=true&db=edsarx&AN=edsarx.1701.04940&site=eds-live&scope=site
https://www.csoonline.com/article/3318238/the-opm-hack-explained-bad-security-practices-meet-chinas-captain-america.html
CYB 250 Stepping Stone One Guidelines and Rubric Introduction to Threat Modeling CYB 250 Stepping Stone One Guidelines and Rubric Introduction to Threat Modeling Overview Threat modeling is an important process to help identify deficiencies in systems that are meant to keep assets secure. Using a framework like the Howard Threat Model while summarizing the attack provides an industry vetted model that allows for easy identification of incidents versus threats. Every cyber incident can be depicted in threat modeling scenarios, which provides an industry standard to communicate the characteristics of any threat. Threat modeling is an important practice for cybersecurity analysts because they must compare different forms of threats to identify common characteristics and build the most secure defense against threats. This activity will draw on important fundamentals we have explored previously, like the confidentiality, integrity, and availability (CIA) triad and adversarial mindset. This activity relates directly to the final project, where you will be required to complete a threat model for your project scenario. Take advantage of feedback on this assignment to prepare you for your final project submission in Module Seven. Prompt Analyze the three breach case studies found in the three articles that are linked in the Reading and Resources section of Module Three of your course. Use this information to fill out the template and address the critical elements listed below. I. Threat Modeling A. To complete this assignment, first download the Stepping Stone One Template from the Stepping Stone assignment in Module Three of your course. Identify the elements of the Howard Threat Model by filling in the template for the case studies below. i. Complete column for Target Breach thoroughly and accurately ii. Complete column for Sony Breach thoroughly and accurately iii. Complete column for OPM Breach thoroughly and accurately II. Incident Analysis Select one of the incidents from the table and analyze the following: A. Which of the CIA triad is most applicable to the “Action” category of the selected incident? Explain your answer. 1 B. How can you use an adversarial mindset in analyzing the “Attackers” and “Objective” to inform the response to the attack? C. Imagine you worked for the organization in the chosen incident and had used a threat model proactively. What changes could you have made to the organization to avoid the incident? III. Threat Modeling Extension A. Defend the need for performing threat modeling. How would you convince your supervisor that threat modeling is worth the time and resources needed to complete it? i. Why is threat modeling an important tool for a security practitioner? ii. What organizational advantages beyond security controls might arise from this threat modeling exercise? B. How does threat modeling differ between roles in IT (for example, testers—data mutations; designers—analyzing threats; developers—tracking data flow)? Stepping Stone One Rubric Guidelines for Submission: Your submission should be 2 to 3 pages in length including the table. Use double spacing, 12-point Times New Roman font, and one-inch margins. All sources must be cited using APA format. Use a file name that includes the course code, the assignment title, and your name—for example, CYB_123_Assignment_Firstname_Lastname.docx. Critical Elements Exemplary (100%) Proficient (85%) Needs Improvement (55%) Not Evident (0%) Value Threat Modeling: Target Breach Meets “Proficient” criteria and addresses critical element in an exceptionally clear, insightful, sophisticated, or creative manner Completes column for Target Breach thoroughly and accurately Addresses “Proficient” criteria, but there are gaps in clarity, logic, or detail Does not address critical element, or response is irrelevant 10 Threat Modeling: Sony Breach Meets “Proficient” criteria and addresses critical element in an exceptionally clear, insightful, sophisticated, or creative manner Completes column for Sony Breach thoroughly and accurately Addresses “Proficient” criteria, but there are gaps in clarity, logic, or detail Does not address critical element, or response is irrelevant 10 2 Critical Elements Exemplary (100%) Proficient (85%) Needs Improvement (55%) Not Evident (0%) Value Threat Modeling: OPM Breach Meets “Proficient” criteria and addresses critical element in an exceptionally clear, insightful, sophisticated, or creative manner Completes column for OPM Breach thoroughly and accurately Addresses “Proficient” criteria, but there are gaps in clarity, logic, or detail Does not address critical element, or response is irrelevant 10 Incident Analysis: CIA Triad Meets “Proficient” criteria and addresses critical element in an exceptionally clear, insightful, sophisticated, or creative manner Explains which of the CIA triad is most applicable to the “Action” category of the selected incident Addresses “Proficient” criteria, but there are gaps in clarity, logic, or detail Does not address critical element, or response is irrelevant 10 Incident Analysis: Adversarial Mindset Meets “Proficient” criteria and addresses critical element in an exceptionally clear, insightful, sophisticated, or creative manner Explains how you can use an adversarial mindset in analyzing the “Attackers” and “Objective” to inform the response to the attack Addresses “Proficient” criteria, but there are gaps in clarity, logic, or detail Does not address critical element, or response is irrelevant 10 Incident Analysis: Avoid the Incident Meets “Proficient” criteria and addresses critical element in an exceptionally clear, insightful, sophisticated, or creative manner Explains what changes could have been made to the organization to avoid the incident Addresses “Proficient” criteria, but there are gaps in clarity, logic, or detail Does not address critical element, or response is irrelevant 10 Threat Modeling Extension: Threat Modeling Meets “Proficient” criteria and addresses critical element in an exceptionally clear, insightful, sophisticated, or creative manner Explains why threat modeling is an important tool for a security practitioner Addresses “Proficient” criteria, but there are gaps in clarity, logic, or detail Does not address critical element, or response is irrelevant 10 Threat Modeling Extension: Organizational Advantages Meets “Proficient” criteria and addresses critical element in an exceptionally clear, insightful, sophisticated, or creative manner Explains what organizational advantages beyond security control might arise from this threat modeling exercise Addresses “Proficient” criteria, but there are gaps in clarity, logic, or detail Does not address critical element, or response is irrelevant 10 3 Critical Elements Exemplary (100%) Proficient (85%) Needs Improvement (55%) Not Evident (0%) Value Threat Modeling Extension: Roles in IT Meets “Proficient” criteria and addresses critical element in an exceptionally clear, insightful, sophisticated, or creative manner Explains how threat modeling differs between roles in IT Addresses “Proficient” criteria, but there are gaps in clarity, logic, or detail Does not address critical element, or response is irrelevant 10 Articulation of Response Submission is free of errors related to citations, grammar, spelling, and organization and is presented in a professional and easy-to-read format Submission has no major errors related to citations, grammar, spelling, or organization Submission has some errors related to citations, grammar, spelling, or organization that negatively impact readability and articulation of main ideas Submission has critical errors related to citations, grammar, spelling, or organization that prevent understanding of ideas 10 Total 100% 4 CYB 250 Stepping Stone One Guidelines and Rubric Introduction to Threat Modeling Overview Prompt Stepping Stone One Rubric CYB 250 Stepping Stone One Template Howard Threat Model Incident Target Breach Sony Breach