Identity Aware Threat Detection and Network Monitoring by using eBPF Natalia Reka Ivanko, Isovalent October 28, 2020 ● ● ○ ● ○ ○ ○ ○ ● ● ● ● ● ● ● ● ○ ● ○ ○ ○ ● ● ● ○ ● ○ ○ ● ●

Table of contents 1 Executive summary 2 Notable findings 3 Project Summary 4 Audit Scope 4 Threat model formalisation 5 Fuzzing 14 Issues found 16 SLSA review 38 Conclusions 40 1 Vitess Security different perspectives. To that end, the audit had the following high-level goals: 1. Formalise a threat model of VTAdmin. 2. Manually audit the VTAdmin code. 3. Manually audit the remaining Vitess code offered a level of synergy; Ada Logics found two CVEʼs during the audit which the threat model goal helped to assess. The threat model was also a force-multiplier for the fuzzing work that led to the discovery

2023 Table of contents Table of contents 1 Executive summary 2 Project Summary 3 Audit Scope 4 Threat model 5 Fuzzing 15 Issues found 17 SLSA 43 Supply-chain mitigations 45 1 Dapr security audit goals: 1. Formalise a threat model of the code assets in scope. 2. Do a manual code audit of the code assets in scope. 3. Evaluate Daprs fuzzing suite against the formalised threat model. 4. Perform a SLSA an out-of-memory denial of service attack vector. We found the vulnerability a�er performing the threat modelling goal and understanding the flow of untrusted data through a Dapr deployment, and then adding

summary 2 Notable findings 3 Project summary 4 Audit scope 6 Overall assessment 7 Fuzzing 9 Threat model 11 Issues found 17 Review of fixes for issues from previous audit 50 Istio SLSA compliance The engagement was a holistic security audit that had several high-level goals: 1. Formalise a threat model of Istio to guide the security audit as well as future security audits. 2. Carry out a manual great foundation for a secure product, and it demonstrates that the Istio community has formulated a threat model that is used to assess which parts of Istio are particularly exposed. In this audit, Ada Logics

Arm-based computer in a secure manner Defense-in-depth Strategy Security Layer Security Measures Threat mitigated/handled Responsibility Policy and procedure Establish policies and procedures to owner (Essential) Malicious code attack that could create or exploit system vulnerabilities (Threat ID #6) Perimeter Security Use LTE service provide with Carrier Grade NAT (CGNAT) and firewall manipulate network traffic (Threat ID #4) Endpoint Security End point Firewall (nftable) Unauthorized and malicious communications from untrusted network (Threat ID #2, Threat ID #5) Provided by

•Interconnected Components •Feature Richness •Backwards CompatibilityFactors Influencing Trends Advanced Threat Detection •Regulatory and Compliance Pressures • Executive Order (US) – Baseline security standards token with the system token.BITTER APT group Who are they? A suspected South Asian cyber espionage threat group that has been active since at least 2013. BITTER has targeted government, energy, and engineering member to offset and the callback returns an arbitrary valuePrintNightmare & Russia State-Sponsored Threat Actor CVE-2021-1675 and CVE-2021-34527 • Remote code execution in Windows Print Spooler • Privilege

easily accessible threat of total compromise. High Implies an immediate threat of system compromise, or an easily accessible threat of large-scale breach. Medium A difficult to exploit threat of large-scale of a small portion of the application. Low Implies a relatively minor threat to the application. Informational No immediate threat to the application. May provide suggestions for application improvement

environment ○ Volume of data ○ Re-keying method ○ Number of key copies ○ Personnel turnover ○ Threat model ○ New and disruptive technologies, e.g., quantum computers Key rotation: compliance PCI {SECRET3}DEK3 + {DEK3}KEKv3 Nov 12-Dec 12 Dec 12 - Jan 11 Jan 11 - Feb 10 KEKv1 KEKv2 KEKv3 KMS plugin: threat model and concerns ● KMS server is compromised ● KMS plugin is compromised ● Auth token for KMS manager In external secret store Kubernetes secrets: summary ● Use encryption based on your threat model, e.g., two layers, like full-disk + application-layer ● Rotate keys regularly to limit the

that can keep pace with rapidly changing technologies and operations, including the evolving cyber threat. Countless articles and reports have documented the failure of IT programs in the current DoD acquisition & ACAT III (Required for space programs only) Request for Proposal MAIS & ACAT III System Threat Assessment Report MAIS & ACAT III Systems Engineering Plan (SEP) MAIS & ACAT III Test and Evaluation Reengineering MAIS & ACAT III Address in Acquisition Strategy and LCSP (Business Case for DBS) Capstone Threat Assessment MAIS & ACAT III Address in Acquisition Strategy (Business Case for DBS) Consideration

specified appropriate file permissions on secure databases, the embedded server itself is no threat. The threat comes from all the other things that the user could install. The fact that the embedded server