FSTEC Threat Model

Ruslan Rakhmetov, Security Vision

When building an information security management system (ISMS), it is important to correctly prioritise, plan costs and efforts, and ensure adequate protection of resources depending on the value of the asset, the cost of protection means and the cost of attackers to conduct a cyberattack. To solve these problems, risk management methods are used to prioritise various cyber threats, assess the severity of the consequences and allocate resources for protection accordingly. However, the list of cyber threats is formed separately - to solve the task of forming a list of actual IS threats, the Russian regulator FSTEC of Russia issued a methodological document ‘Methodology for Assessing Information Security Threats’ (approved on 05.02.2021). The provisions of this methodology contain a description of the sequential steps to be followed in order to create a list of current cyber threats in a particular organisation. It should also be noted that before the publication of this methodological document, companies could be guided by the document ‘Basic model of threats to the security of personal data during their processing in personal data information systems’, which was approved by the FSTEC of Russia back in 2008, but the sequence of actions and the logic of forming a threat model in it differed significantly from what is set out in the current document.

So, information security threat assessment is carried out to determine the list of current cyber threats, which is the result of work carried out in the organisation on a regular basis when creating and upgrading information systems. This work is carried out by a group of experts - information protection specialists, with the participation of employees of the company's specialised departments and with the possibility of engaging third-party contractors. Formation of the current threat model includes the following main steps:

1. Collecting information and documentation on information systems and networks used in the company, describing business processes and their dependencies on information systems and networks, obtaining contacts of responsible employees, forming an expert working group.

2 Analysing the results of the previous cyber risk assessment, studying information on current methods, techniques, tactics, techniques and procedures of cyber attacks (based on open sources, including data from MITRE ATT&CK, MITRE CAPEC, OWASP, etc.), as well as creating a general list of cyber threats based on information from the threat database of the FSTEC of Russia, which is available at this address and is constantly updated and supplemented.

3. When creating a list of negative consequences of information security threats relevant to the company, the list of negative consequences from the DBU or from Appendix No. 4 to the Methodology under consideration can be used as a basis. The document stresses that based on the results of the analysis of the initial data on the processes and infrastructure of the organisation, a list of possible events (consequences) is formed, the occurrence of which may result in negative consequences for citizens (violation of their legal rights), for the state (damage to defence capability and law and order, negative impact on the social and political sphere, damage to economic, environmental or food security) or for the company - owner of the information (financial, production, reputational damage). The document lists such possible negative consequences as threat to life and health, violation of privacy, disclosure of personal data of citizens, violation by the company of the current legislation of the Russian Federation, embezzlement of funds from the company, loss of profit, disruption of transactions, unplanned expenses for payment of fines or for restoration of operations, loss of clients, damage to business reputation, making wrong management decisions by the company's executives, termination or disruption of the functioning of the state

4. Formation of a list of likely targets of cyber threats, including analysis of collected information on systems and networks, network diagrams, diagrams of interaction of information systems and processes. It is important to identify objects of potential negative impact at the application, system, network, hardware, and user levels. As part of forming the list of objects of impact, the authors of the Methodology under consideration recommend using automation tools to conduct an inventory of information systems and networks, identify their components and interfaces (external and internal). The document also stresses that when operating systems provided under IaaS (‘infrastructure as a service’), PaaS (‘platform as a service’), SaaS (‘software as a service’) models, it is important to separate the areas of responsibility and the boundaries of threat assessment between the operator and the provider of such services (e.g., data centres or cloud infrastructures). A typical list of impacted entities is provided in the BDU, which also lists the typical components of these impacted entities.

5. The assessment of the possibility of cyber threats and the creation of the final list of current IS threats is carried out in three stages:

5.1 Determining the sources of cyber threats and creating a list of actual intruders is based on analysing the previously collected baseline data, data from the DBU and industry threat models, as well as taking into account the previously formed list of negative consequences and impact objects. The Methodology provides a list of the main types of intruders whose capabilities and motivation should be assessed at this stage: intelligence services of unfriendly states, organised cybercriminal groups, lone hackers, competitors, software developers and service providers, contractors and outsourcers, administrators, users, terminated employees, etc., some of whom may also collude with each other.

Organisationally relevant attackers are those whose goals of cyberattacks may lead to negative consequences and damage that are relevant to the company. At the same time, attackers are subdivided according to the level of capabilities (equipped with resources), competences, and motivation into intruders with basic, basic enhanced, medium or high capabilities, as well as according to the level of access and authority in information systems (external and internal intruders). A description of the types and capabilities of intruders is provided in the BDU. In addition to these anthropogenic sources of threats to information security, the authors of the methodology talk about the possibility of additional consideration of technogenic sources of threats (physical phenomena, material objects).

5.2 Next, an assessment is made of the ways of realising cyber threats that can be used by actual intruders to attack the probable objects of influence, the list of which was formed at the previous stages. At the same time, the ways of realising an IS threat are considered relevant if the actual attackers have the appropriate level of capabilities, as well as if the conditions for realising such capabilities exist - it should be taken into account that the same threat can be realised in different ways. In addition to having the necessary level of capabilities, in order to successfully implement a cyber threat, attackers must have access to the interfaces of the target through which the attack will be carried out - network interfaces, interfaces for the operation of peripheral equipment, and interfaces for logical and physical access to system and network components. A typical list of ways of threat realisation is given in the BDU. As a result of the work at this stage, a list of actual ways of realising IS threats should be formed, indicating the probable types of interfaces of objects of influence through which an attack can be carried out, as well as a list of types and categories of attackers who have the ability to use these methods.

5.3 The list of current threats is generated at the final stage as a result of the assessment of possible cyber threats. A typical list of threats to information security is provided in the BDU, but in addition to it, organisations should be guided by the results of work performed at previous stages - lists of actual negative consequences, objects and types of impact, actual intruders and methods of threat implementation. A cyber threat is considered possible if there is a source of the threat (intruder), an object of influence, a way of threat realisation, and negative consequences from the threat realisation. However, not all theoretically possible cyber threats will be relevant - for an IS threat to be considered relevant, there must be at least one scenario in which the threat is realised. An IS threat scenario is a sequence of possible tactics and techniques available for use by actual perpetrators. Annex No. 11 to the Methodology under consideration provides a typical list of attacker tactics and techniques, but the data from the regularly updated MITRE ATT&CK matrix can be used to form the most up-to-date and complete list of attack scenarios. Once the list of current cyber threats has been compiled, to justify the choice of protection means, one can refer to the section of the BDU, which lists the main information protection measures, indicating the threats they address and the ways in which they are implemented.

In conclusion, it should be noted that the FSTEC of Russia is currently piloting an upgraded threat section on the BDU website, which provides a tool for automating the process of creating a list of possible threats to information security - albeit in a fairly generic version that should be expanded and adapted by organisations, taking into account the specifics of their infrastructure and business processes.