Introduction to Threat Modeling and the Adversary Concept

Hello! Welcome to the first lesson in our course on building a secure ThinkPad. I'm excited to get started with you on this project.

Introduction

This first module lays the conceptual groundwork for everything that follows. Before we dive into hardware modifications and software installations, we must first establish a clear and rigorous security philosophy. This is the "why" that will inform all of our subsequent "hows."

Today's lesson addresses the first, most fundamental concept in security engineering: threat modeling. We will define what threat modeling is and explore the crucial concept of the 'adversary'. Understanding who you are defending against is the essential first step in building any effective defense. Your background in risk assessment and critical analysis will be a great asset here, as the logic is quite similar to evaluating economic or financial risks.

This lesson should take you approximately 60 minutes to complete.

---

1. What is Threat Modeling? A Critical Approach to Security

At its heart, threat modeling is a structured, systematic process for identifying and evaluating potential security threats to a system. Instead of waiting for an attack to happen, you proactively put on an attacker's hat and ask: "If I wanted to break this, how would I do it?"

This proactive and critical mindset might remind you of the Popperian approach to science. We are not trying to prove a system is secure (a form of justificationism that is often impossible). Instead, we are attempting to falsify its security by conjecturing potential attacks. A system we consider "secure" is simply one that has, so far, withstood our most rigorous and imaginative attempts to find its flaws.

To begin, please read the introductory section of this guide from the UK's National Cyber Security Centre (NCSC). It provides a concise, high-level overview of the concept.

Reading (5 mins):
Please read the "Introduction" and "When should threat modelling be used?" sections of the following document.

Threat Modelling - Risk management (Introduction to Threat Modelling)

As the NCSC guide states, threat modeling helps us "apply an adversarial perspective." This is the core idea. It's a shift from just building something that works to building something that can withstand attempts to make it fail.

To see this principle in a practical context, let's watch the introduction to a video by the security researcher LiveOverflow. He discusses threat models in the context of cryptocurrency hardware wallets, which, like our ThinkPad project, are all about protecting valuable digital assets.

Video (1 min):
Watch the first minute of this video to see how threat modeling is framed in a real-world security problem.

2. The Adversary: Who Are You Defending Against?

The first question in any threat model is always: "Who is the threat?" A system that is secure against a casual thief might be completely vulnerable to a dedicated nation-state agency. Defining your adversary (or "threat actor") is the most critical step, as it determines the scope and rigor of the defenses you need to build.

An adversary is defined by three main characteristics:

1. Intent (or Motivation): What is their goal? To steal your data? To install ransomware? To monitor your communications? To simply cause disruption?
2. Capabilities (or Resources): What skills, tools, time, and funding do they possess? Are they a lone hobbyist, a criminal organization, or a government intelligence agency?
3. Access: What is their point of entry? Do they have physical access to your laptop, or can they only attack it remotely over the internet?

Let's start by reading the NCSC's guidance on this.

Reading (5 mins):
Please read the section "Understand who might be motivated to harm you" from the NCSC guide.

Threat Modelling - Risk management (Understanding Adversaries)

A Tale of Two Wallets

To make this concept tangible, let's return to the LiveOverflow video. He uses a brilliant analogy of a "paper wallet" versus a "hardware wallet" to illustrate how different systems are designed to counter different adversaries.

Video (3 mins):
Watch these two segments. The first uses the simple example of a paper wallet to show how we intuitively understand threats. The second explains the primary adversary that hardware wallets are designed to defeat.

1. Highlight 1: 0:00 - 0:00
2. Highlight 2: 0:00 - 0:00

Think about the paper wallet example. The adversaries are simple and intuitive:

• A house fire: Intent = N/A; Capability = Destruction by heat; Access = Physical proximity.
• A burglar: Intent = Theft; Capability = Physical entry into your home; Access = Physical.
• Your own carelessness: Intent = N/A; Capability = Accidental loss or damage; Access = Physical.

The hardware wallet, in contrast, is primarily designed to protect against a different, more technical adversary: malware on your primary computer.

• Malware: Intent = Steal private keys; Capability = Execute code on your PC; Access = Remote, via the internet/OS.

The hardware wallet isolates the keys from the potentially compromised computer, thus defeating that specific adversary.

This diagram, called an Attack Execution Graph, provides a more formal way to visualize how an adversary combines their access and skills to reach a goal.

This Attack Execution Graph shows how an adversary can combine different forms of access (Internet, Local Physical) and capabilities (VPN Exploit Skill, Password Knowledge) to achieve their goal of embarrassing a company by gaining access to its corporate network.

The Perils of a Flawed Model

What happens when you incorrectly or incompletely define your adversary? You build a flawed defense. LiveOverflow's critique of the Bitfi wallet is a masterclass in identifying a poor threat model. Bitfi defined their adversary very narrowly—someone trying to extract coins from a stolen device—while ignoring the much more likely adversary of malware on the device itself.

Video (2 mins):
Watch this segment where LiveOverflow critiques the Bitfi wallet's "unhackable" claim by attacking its flawed threat model.

This is a crucial lesson: a security system is only as good as the threat model that underpins it. A narrow or unrealistic definition of the adversary leads to a false sense of security.

3. From Adversary to Threat: A Vocabulary of Attack

Once you have a clear picture of your adversary (the "who"), you can start to systematically enumerate the specific things they might do (the "what"). Security professionals use frameworks to ensure this process is comprehensive.

One of the most common frameworks is STRIDE, a mnemonic developed at Microsoft. For our purposes today, you don't need to memorize the whole process. Instead, think of STRIDE as a useful vocabulary for describing the goals of an adversary.

Video (6 mins):
Watch this section of the video to learn the six categories of the STRIDE framework. Focus on understanding what each category means.

Here are the STRIDE categories, which represent the goals of an adversary:

• Spoofing: Impersonating another user, component, or system.
• Tampering: Modifying data on disk, in memory, or in transit.
• Repudiation: Denying that an action was performed.
• Information Disclosure: Gaining access to private or sensitive information.
• Denial of Service: Preventing legitimate users from accessing the system.
• Elevation of Privilege: Gaining capabilities without proper authorization.

By considering your defined adversary and thinking through each of these categories, you can begin to build a comprehensive list of potential threats. For example, if your adversary is "malware on your PC," it might achieve Information Disclosure by logging your keystrokes to steal a password.

---

Conclusion

In this lesson, we've laid the philosophical foundation for our entire project. We've moved beyond a vague notion of "security" and toward a more rigorous, critical framework for thinking about it.

Key Takeaways:

• Threat Modeling is a structured, proactive process of identifying security risks by adopting an adversarial perspective. It's about finding flaws before an attacker does.
• The Adversary is the central concept in any threat model. A useful definition must articulate their Intent, Capabilities, and Access.
• A robust security plan requires considering a realistic and comprehensive range of potential adversaries, from the casual opportunist to the dedicated attacker.
• Frameworks like STRIDE provide a vocabulary to describe the specific goals an adversary might pursue, such as tampering with data or spoofing an identity.

Preview of the Next Lesson:

In our next lesson, we will put this theory into practice. You will formulate a personal threat model for your x230 project. We will define the assets you want to protect and identify the specific adversaries you are concerned about. This document will become our north star, guiding every technical decision we make, from choosing firmware to configuring the operating system.