Oikeushallinnon tietotekniikkaympäristön uhkamallinnus - Hautaviita, Mikko (2024)
ABSTRACT Hautaviita, Mikko Legal administration information technology environmental threat modeling Jyväskylä: University of Jyväskylä, 2024, 92 pp. Cyber Security, Master’s Thesis Supervisor: Frantti, Tapio This research investigated the key risks of the information technology environment of the legal administration and the means of managing them. In addition, the research figured out how threats can be identified using threat modeling. The information technology environment of the legal administration was threat modeled with software-based threat modeling using the STRIDE methodology. STRIDE consists of six elements, which are spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege. The Elevation of Privilege and Backdoors & Breaches card sets were used to help with threat modeling, and a total of 80 cards were processed. The threat modeling was carried out by working in a workshop with the information security manager of the target organization and an IT specialist. A total of 105 risks were identified in the threat modeling, the impact of which was classified as low or moderate. Significant and critical risks were also identified in the threat modeling, but for information security reasons, these risks are not dealt with in this research. In appendix two of the research, the researcher gives an example of handling a critical threat to improve reliability. Threat modeling is a key part of the target organization's risk management because some of the identified risks were transferred for further processing in the risk management process. Threat modeling focuses on examining system weaknesses and vulnerabilities that affect the target system. The purpose of threat modeling is to identify threats that other methods do not detect. The research found the importance of information security training for users, because with the help of training, numerous information security deviations are prevented. From a technical point of view, it was found that EDR, UEBA and DLP are important tools in today's digital operating environment that improve the information security of organizations. Other significant factors for improving information security were found, including writing secure programming code, penetration testing and passwordless authentication. Keywords: threat modeling, risk management, STRIDE, threat, risk