From the course: Threat Modeling: Tampering in Depth

Unlock the full course today

Join today to access over 22,400 courses taught by industry experts or purchase this course individually.

Becoming Jane Admin

Becoming Jane Admin

From the course: Threat Modeling: Tampering in Depth

Start my 1-month free trial

Becoming Jane Admin

- [Instructor] When an attacker breaks into a cloud service, they'll often tamper with the controls. At a corporate level, attackers will sometimes make themselves an admin and sometimes not, because making yourself an admin can trigger alarms. You might ask, is this tampering? It's authorized. They're using the service as designed just like someone modifying a file in Office 365 is authorized, only not quite. There's a disconnect between the technical authorization and the human level authorization. An important function of threat modeling is to make sure those align. When an attacker tampers with the authentication controls, the attacks seem to blend into spoofing. This can be really confusing. We want to be able to store ideas in cubbyholes. This is spoofing, that's tampering. Unfortunately, the universe doesn't always work that way. This is a reptile, it lays eggs. That's a mammal, it has live babies. That's a duck…

Contents