Skip to content

Latest commit

 

History

History
58 lines (49 loc) · 8.39 KB

threat-modeling.md

File metadata and controls

58 lines (49 loc) · 8.39 KB

Threat Model Analysis for netflix/asgard

Threat: Asgard API Spoofing (via DNS Hijacking/MITM)

  • Description: An attacker intercepts DNS requests for the Asgard server and redirects them to a malicious server controlled by the attacker. Alternatively, a Man-in-the-Middle (MITM) attack intercepts traffic between the client and Asgard, impersonating the Asgard server. The attacker presents a fake Asgard login page or API endpoint, capturing credentials or manipulating requests. This directly targets Asgard's exposed API.
  • Impact: Users unknowingly interact with the attacker's server, providing credentials or making requests that are intercepted and potentially modified. This can lead to complete compromise of the AWS environment managed by Asgard, due to Asgard's role as a management tool.
  • Affected Asgard Component: Asgard's core web server and API endpoints (e.g., com.netflix.asgard.controllers package and related classes handling request routing and authentication). The underlying Grails framework's request handling is also directly involved.
  • Risk Severity: Critical
  • Mitigation Strategies:
    • Strict HTTPS Enforcement: Ensure Asgard is only accessible via HTTPS, with no HTTP fallback. This is a direct configuration of Asgard.
    • Certificate Pinning (If Feasible): Consider pinning the Asgard server's certificate in client applications (if applicable) to prevent MITM attacks using forged certificates. This is a client-side mitigation, but directly protects against Asgard spoofing.
    • HSTS (HTTP Strict Transport Security): Configure Asgard (within its web server configuration) to send HSTS headers, instructing browsers to only connect via HTTPS for a specified period.
    • DNSSEC: Implement DNSSEC to prevent DNS spoofing attacks (infrastructure-level, but crucial for preventing this Asgard-specific threat).
    • VPN/Secure Network: Access Asgard only through a trusted network or VPN, reducing the risk of MITM attacks on public networks (operational control, but directly relevant).
    • Regular Security Audits: Conduct regular security audits of the network infrastructure and Asgard's configuration.

Threat: Credential Injection via Configuration

  • Description: An attacker gains access to Asgard's configuration files (e.g., AsgardSettings.groovy, environment variables) and injects malicious AWS credentials or modifies existing ones. This could be through a server compromise, access to a shared configuration repository, or social engineering. This directly targets how Asgard stores and uses credentials.
  • Impact: The attacker gains control over the AWS resources managed by Asgard, potentially with elevated privileges. They can launch instances, modify security groups, access data, and cause significant damage, leveraging Asgard's intended functionality.
  • Affected Asgard Component: Configuration loading and handling mechanisms within Asgard (e.g., com.netflix.asgard.Config class and related methods for reading and parsing configuration files). This is a vulnerability within Asgard's code.
  • Risk Severity: Critical
  • Mitigation Strategies:
    • IAM Roles: Use IAM Roles for EC2 instances running Asgard exclusively. Never store AWS credentials directly in Asgard's configuration files. This is an AWS best practice, but critical for preventing this Asgard-specific vulnerability.
    • Secrets Management: Use AWS Secrets Manager (or a similar service) to store and retrieve any sensitive configuration values (database passwords, API keys). Asgard's code should be modified to retrieve these secrets at runtime, rather than storing them statically.
    • Configuration Management: Use a configuration management system (Chef, Puppet, Ansible) to manage Asgard's configuration, ensuring consistency and preventing manual modifications. This helps prevent unauthorized changes to Asgard's configuration.
    • File Integrity Monitoring (FIM): Implement FIM to detect unauthorized changes to Asgard's configuration files.
    • Least Privilege: Ensure the IAM Role assigned to Asgard has the absolute minimum permissions required. This limits the impact even if credentials are compromised.
    • Regular Audits: Regularly audit IAM Roles and policies, and review Asgard's configuration files for any signs of tampering.

Threat: Unauthorized Deployment via API Abuse

  • Description: An attacker, with compromised user credentials or through an unauthenticated or poorly authorized API endpoint within Asgard, uses Asgard's deployment API to launch unauthorized instances, modify existing deployments, or deploy malicious code. This is a direct attack on Asgard's core functionality.
  • Impact: The attacker can deploy malicious applications, exfiltrate data, disrupt services, or cause financial damage by launching excessive resources, all through Asgard's intended deployment mechanisms.
  • Affected Asgard Component: Asgard's deployment-related controllers and services (e.g., com.netflix.asgard.deployment package, classes like DeploymentController, AutoScalingController, and related methods). This is a vulnerability in Asgard's API design and implementation.
  • Risk Severity: High
  • Mitigation Strategies:
    • Strong Authentication: Implement strong authentication for all Asgard API endpoints, including multi-factor authentication (MFA). This is a direct configuration of Asgard's security.
    • RBAC (Role-Based Access Control): Implement granular RBAC within Asgard to restrict deployment capabilities based on user roles. This requires modifications to Asgard's authorization logic.
    • API Rate Limiting: Implement rate limiting on Asgard's API to prevent attackers from flooding the API with deployment requests. This is a direct configuration of Asgard's API handling.
    • Input Validation: Thoroughly validate all input parameters to Asgard's deployment API to prevent injection attacks. This requires careful code review and secure coding practices within Asgard.
    • Approval Workflows: Implement approval workflows within Asgard for deployments, requiring manual approval from authorized personnel before resources are launched. This would likely require custom development within Asgard.
    • Audit Logging: Ensure detailed audit logging of all deployment-related API calls made to Asgard.

Threat: Privilege Escalation via Asgard Vulnerability

  • Description: A vulnerability in Asgard's code itself (e.g., a command injection flaw, insecure deserialization, a logic error in authorization checks) allows an attacker to escalate their privileges within the Asgard application or the underlying operating system. This is a direct vulnerability within Asgard.
  • Impact: The attacker gains control over the Asgard server and, because of Asgard's role, potentially gains unauthorized access to the AWS resources it manages.
  • Affected Asgard Component: Potentially any Asgard component, depending on the specific vulnerability. This highlights the importance of secure coding practices across the entire Asgard codebase.
  • Risk Severity: High
  • Mitigation Strategies:
    • Regular Security Updates: Keep Asgard and its dependencies (Grails, Java, etc.) up to date with the latest security patches. This is crucial for addressing known vulnerabilities in Asgard or its libraries.
    • Secure Coding Practices: Follow secure coding practices (e.g., OWASP Top 10) during Asgard's development to prevent common vulnerabilities.
    • Input Validation: Thoroughly validate all user input to Asgard to prevent injection attacks. This is a fundamental security principle for any web application, including Asgard.
    • Penetration Testing: Conduct regular penetration testing specifically targeting Asgard to identify and fix vulnerabilities.
    • Static Code Analysis: Use static code analysis tools to identify potential security flaws in Asgard's code during development.
    • Least Privilege: Run Asgard with the least privilege necessary on the operating system. This limits the impact of a successful privilege escalation.