| description |
ABSTRACT
Hautaviita, Mikko
Legal administration information technology environmental threat modeling
Jyväskylä: University of Jyväskylä, 2024, 92 pp.
Cyber Security, Master’s Thesis
Supervisor: Frantti, Tapio
This research investigated the key risks of the information technology environment of the legal administration and the means of managing them. In addition, the research figured out how threats can be identified using threat modeling.
The information technology environment of the legal administration was threat modeled with software-based threat modeling using the STRIDE methodology. STRIDE consists of six elements, which are spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege. The Elevation of Privilege and Backdoors & Breaches card sets were used to help with threat modeling, and a total of 80 cards were processed. The threat modeling was carried out by working in a workshop with the information security manager of the target organization and an IT specialist.
A total of 105 risks were identified in the threat modeling, the impact of which was classified as low or moderate. Significant and critical risks were also identified in the threat modeling, but for information security reasons, these risks are not dealt with in this research. In appendix two of the research, the researcher gives an example of handling a critical threat to improve reliability.
Threat modeling is a key part of the target organization's risk management because some of the identified risks were transferred for further processing in the risk management process. Threat modeling focuses on examining system weaknesses and vulnerabilities that affect the target system. The purpose of threat modeling is to identify threats that other methods do not detect.
The research found the importance of information security training for users, because with the help of training, numerous information security deviations are prevented. From a technical point of view, it was found that EDR, UEBA and DLP are important tools in today's digital operating environment that improve the information security of organizations. Other significant factors for improving information security were found, including writing secure programming code, penetration testing and passwordless authentication.
Keywords: threat modeling, risk management, STRIDE, threat, risk
TIIVISTELMÄ
Hautaviita, Mikko
Oikeushallinnon tietotekniikkaympäristön uhkamallinnus
Jyväskylä: Jyväskylän yliopisto, 2024, 92 s.
Kyberturvallisuus, pro gradu -tutkielma
Ohjaaja: Frantti, Tapio
Tutkimuksessa selvitettiin oikeushallinnon tietotekniikkaympäristön keskeiset riskit ja niiden hallintakeinot. Lisäksi tutkimuksessa selvitettiin, miten uhkia voidaan tunnistaa uhkamallinnuksen avulla.
Oikeushallinnon tietotekniikkaympäristö uhkamallinnettiin ohjelmistokeskeisellä uhkamallinnuksella STRIDE-metodologian avulla. STRIDE koostuu kuudesta elementistä, jotka ovat huijaus (engl. spoofing), peukalointi (engl. tampering), kiistäminen (engl. repudiation), tietojen paljastaminen (engl. information disclosure), palvelunesto (engl. denial of service) ja oikeuksien korottaminen (engl. elevation of privilege). Uhkamallinnuksen apuna käytettiin Elevation of Privilege- ja Backdoors & Breaches -korttisarjoja, joista käsiteltiin yhteensä 80 korttia. Uhkamallinnus toteutettiin työpajatyöskentelyllä kohdeorganisaation tietoturvapäällikön ja it-erityisasiantuntijan kanssa.
Uhkamallinnuksessa tunnistettiin yhteensä 105 riskiä, joiden vaikutus luokiteltiin vähäiseksi tai kohtalaiseksi. Uhkamallinnuksessa tunnistettiin myös merkittäviä ja kriittisiä riskejä, mutta tietoturvasyistä kyseisiä riskejä ei käsitellä tässä tutkimuksessa. Tutkimuksen liitteessä kaksi tutkija antaa esimerkin kriittisen uhkan käsittelystä luotettavuuden parantamiseksi.
Uhkamallinnus on keskeinen osa kohdeorganisaation riskienhallintaa, koska osa tunnistetuista riskeistä siirrettiin riskienhallintaprosessissa jatkokäsittelyä varten. Uhkien mallintamisessa keskitytään tarkastelemaan järjestelmän heikkouksia ja haavoittuvuuksia, jotka vaikuttavat kohdejärjestelmään. Uhkamallinnuksen tarkoituksena on tunnistaa uhkia, joita muut menetelmät eivät havaitse.
Tutkimuksessa havaittiin tunnistettujen uhkaskenaarioiden avulla käyttäjien tietoturvakoulutuksen tärkeys, koska koulutuksen avulla ehkäistään lukuisia tietoturvapoikkeamia. Teknisestä näkökulmasta tarkasteltuna havaittiin, että EDR, UEBA ja DLP ovat nykyajan digitaalisessa toimintaympäristössä merkittäviä työkaluja, jotka parantavat organisaatioiden tietoturvaa. Muita merkittäviä tekijöitä tietoturvan parantamiseen havaittiin muun muassa turvallisen ohjelmointikoodin kirjoittaminen, penetraatiotestaus ja salasanattomuus.
Asiasanat: uhkamallinnus, riskienhallinta, STRIDE, uhka, riski
|
| fullrecord |
[{"key": "dc.contributor.advisor", "value": "Frantti, Tapio", "language": null, "element": "contributor", "qualifier": "advisor", "schema": "dc"}, {"key": "dc.contributor.author", "value": "Hautaviita, Mikko", "language": null, "element": "contributor", "qualifier": "author", "schema": "dc"}, {"key": "dc.date.accessioned", "value": "2024-05-17T09:05:35Z", "language": null, "element": "date", "qualifier": "accessioned", "schema": "dc"}, {"key": "dc.date.available", "value": "2024-05-17T09:05:35Z", "language": null, "element": "date", "qualifier": "available", "schema": "dc"}, {"key": "dc.date.issued", "value": "2024", "language": null, "element": "date", "qualifier": "issued", "schema": "dc"}, {"key": "dc.identifier.uri", "value": "https://jyx.jyu.fi/handle/123456789/94950", "language": null, "element": "identifier", "qualifier": "uri", "schema": "dc"}, {"key": "dc.description.abstract", "value": "ABSTRACT\nHautaviita, Mikko \nLegal administration information technology environmental threat modeling\nJyv\u00e4skyl\u00e4: University of Jyv\u00e4skyl\u00e4, 2024, 92 pp.\nCyber Security, Master\u2019s Thesis\nSupervisor: Frantti, Tapio\nThis research investigated the key risks of the information technology environment of the legal administration and the means of managing them. In addition, the research figured out how threats can be identified using threat modeling. \nThe information technology environment of the legal administration was threat modeled with software-based threat modeling using the STRIDE methodology. STRIDE consists of six elements, which are spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege. The Elevation of Privilege and Backdoors & Breaches card sets were used to help with threat modeling, and a total of 80 cards were processed. The threat modeling was carried out by working in a workshop with the information security manager of the target organization and an IT specialist.\nA total of 105 risks were identified in the threat modeling, the impact of which was classified as low or moderate. Significant and critical risks were also identified in the threat modeling, but for information security reasons, these risks are not dealt with in this research. In appendix two of the research, the researcher gives an example of handling a critical threat to improve reliability.\nThreat modeling is a key part of the target organization's risk management because some of the identified risks were transferred for further processing in the risk management process. Threat modeling focuses on examining system weaknesses and vulnerabilities that affect the target system. The purpose of threat modeling is to identify threats that other methods do not detect.\nThe research found the importance of information security training for users, because with the help of training, numerous information security deviations are prevented. From a technical point of view, it was found that EDR, UEBA and DLP are important tools in today's digital operating environment that improve the information security of organizations. Other significant factors for improving information security were found, including writing secure programming code, penetration testing and passwordless authentication.\nKeywords: threat modeling, risk management, STRIDE, threat, risk", "language": "en", "element": "description", "qualifier": "abstract", "schema": "dc"}, {"key": "dc.description.abstract", "value": "TIIVISTELM\u00c4\nHautaviita, Mikko\nOikeushallinnon tietotekniikkaymp\u00e4rist\u00f6n uhkamallinnus\nJyv\u00e4skyl\u00e4: Jyv\u00e4skyl\u00e4n yliopisto, 2024, 92 s.\nKyberturvallisuus, pro gradu -tutkielma\nOhjaaja: Frantti, Tapio\nTutkimuksessa selvitettiin oikeushallinnon tietotekniikkaymp\u00e4rist\u00f6n keskeiset riskit ja niiden hallintakeinot. Lis\u00e4ksi tutkimuksessa selvitettiin, miten uhkia voidaan tunnistaa uhkamallinnuksen avulla. \nOikeushallinnon tietotekniikkaymp\u00e4rist\u00f6 uhkamallinnettiin ohjelmistokeskeisell\u00e4 uhkamallinnuksella STRIDE-metodologian avulla. STRIDE koostuu kuudesta elementist\u00e4, jotka ovat huijaus (engl. spoofing), peukalointi (engl. tampering), kiist\u00e4minen (engl. repudiation), tietojen paljastaminen (engl. information disclosure), palvelunesto (engl. denial of service) ja oikeuksien korottaminen (engl. elevation of privilege). Uhkamallinnuksen apuna k\u00e4ytettiin Elevation of Privilege- ja Backdoors & Breaches -korttisarjoja, joista k\u00e4siteltiin yhteens\u00e4 80 korttia. Uhkamallinnus toteutettiin ty\u00f6pajaty\u00f6skentelyll\u00e4 kohdeorganisaation tietoturvap\u00e4\u00e4llik\u00f6n ja it-erityisasiantuntijan kanssa.\nUhkamallinnuksessa tunnistettiin yhteens\u00e4 105 riski\u00e4, joiden vaikutus luokiteltiin v\u00e4h\u00e4iseksi tai kohtalaiseksi. Uhkamallinnuksessa tunnistettiin my\u00f6s merkitt\u00e4vi\u00e4 ja kriittisi\u00e4 riskej\u00e4, mutta tietoturvasyist\u00e4 kyseisi\u00e4 riskej\u00e4 ei k\u00e4sitell\u00e4 t\u00e4ss\u00e4 tutkimuksessa. Tutkimuksen liitteess\u00e4 kaksi tutkija antaa esimerkin kriittisen uhkan k\u00e4sittelyst\u00e4 luotettavuuden parantamiseksi. \nUhkamallinnus on keskeinen osa kohdeorganisaation riskienhallintaa, koska osa tunnistetuista riskeist\u00e4 siirrettiin riskienhallintaprosessissa jatkok\u00e4sittely\u00e4 varten. Uhkien mallintamisessa keskityt\u00e4\u00e4n tarkastelemaan j\u00e4rjestelm\u00e4n heikkouksia ja haavoittuvuuksia, jotka vaikuttavat kohdej\u00e4rjestelm\u00e4\u00e4n. Uhkamallinnuksen tarkoituksena on tunnistaa uhkia, joita muut menetelm\u00e4t eiv\u00e4t havaitse.\nTutkimuksessa havaittiin tunnistettujen uhkaskenaarioiden avulla k\u00e4ytt\u00e4jien tietoturvakoulutuksen t\u00e4rkeys, koska koulutuksen avulla ehk\u00e4ist\u00e4\u00e4n lukuisia tietoturvapoikkeamia. Teknisest\u00e4 n\u00e4k\u00f6kulmasta tarkasteltuna havaittiin, ett\u00e4 EDR, UEBA ja DLP ovat nykyajan digitaalisessa toimintaymp\u00e4rist\u00f6ss\u00e4 merkitt\u00e4vi\u00e4 ty\u00f6kaluja, jotka parantavat organisaatioiden tietoturvaa. Muita merkitt\u00e4vi\u00e4 tekij\u00f6it\u00e4 tietoturvan parantamiseen havaittiin muun muassa turvallisen ohjelmointikoodin kirjoittaminen, penetraatiotestaus ja salasanattomuus.\nAsiasanat: uhkamallinnus, riskienhallinta, STRIDE, uhka, riski", "language": "fi", "element": "description", "qualifier": "abstract", "schema": "dc"}, {"key": "dc.description.provenance", "value": "Submitted by jyx lomake-julkaisija (jyx-julkaisija.group@korppi.jyu.fi) on 2024-05-17T09:05:35Z\r\nNo. of bitstreams: 0", "language": "en", "element": "description", "qualifier": "provenance", "schema": "dc"}, {"key": "dc.description.provenance", "value": "Made available in DSpace on 2024-05-17T09:05:35Z (GMT). No. of bitstreams: 0", "language": "en", "element": "description", "qualifier": "provenance", "schema": "dc"}, {"key": "dc.format.extent", "value": "92", "language": null, "element": "format", "qualifier": "extent", "schema": "dc"}, {"key": "dc.format.mimetype", "value": "application/pdf", "language": null, "element": "format", "qualifier": "mimetype", "schema": "dc"}, {"key": "dc.language.iso", "value": "fin", "language": null, "element": "language", "qualifier": "iso", "schema": "dc"}, {"key": "dc.rights", "value": "CC BY 4.0", "language": "en", "element": "rights", "qualifier": null, "schema": "dc"}, {"key": "dc.title", "value": "Oikeushallinnon tietotekniikkaymp\u00e4rist\u00f6n uhkamallinnus", "language": null, "element": "title", "qualifier": null, "schema": "dc"}, {"key": "dc.type", "value": "master thesis", "language": null, "element": "type", "qualifier": null, "schema": "dc"}, {"key": "dc.identifier.urn", "value": "URN:NBN:fi:jyu-202405173714", "language": null, "element": "identifier", "qualifier": "urn", "schema": "dc"}, {"key": "dc.contributor.faculty", "value": "Faculty of Information Technology", "language": "en", "element": "contributor", "qualifier": "faculty", "schema": "dc"}, {"key": "dc.contributor.faculty", "value": "Informaatioteknologian tiedekunta", "language": "fi", "element": "contributor", "qualifier": "faculty", "schema": "dc"}, {"key": "dc.contributor.organization", "value": "University of Jyv\u00e4skyl\u00e4", "language": "en", "element": "contributor", "qualifier": "organization", "schema": "dc"}, {"key": "dc.contributor.organization", "value": "Jyv\u00e4skyl\u00e4n yliopisto", "language": "fi", "element": "contributor", "qualifier": "organization", "schema": "dc"}, {"key": "dc.subject.discipline", "value": "Cyber Security", "language": "en", "element": "subject", "qualifier": "discipline", "schema": "dc"}, {"key": "dc.subject.discipline", "value": "Kyberturvallisuus", "language": "fi", "element": "subject", "qualifier": "discipline", "schema": "dc"}, {"key": "dc.type.coar", "value": "http://purl.org/coar/resource_type/c_bdcc", "language": null, "element": "type", "qualifier": "coar", "schema": "dc"}, {"key": "dc.rights.copyright", "value": "\u00a9 The Author(s)", "language": null, "element": "rights", "qualifier": "copyright", "schema": "dc"}, {"key": "dc.rights.accesslevel", "value": "openAccess", "language": null, "element": "rights", "qualifier": "accesslevel", "schema": "dc"}, {"key": "dc.type.publication", "value": "masterThesis", "language": null, "element": "type", "qualifier": "publication", "schema": "dc"}, {"key": "dc.format.content", "value": "fulltext", "language": null, "element": "format", "qualifier": "content", "schema": "dc"}, {"key": "dc.rights.url", "value": "https://creativecommons.org/licenses/by/4.0/", "language": null, "element": "rights", "qualifier": "url", "schema": "dc"}]
|