Cornucopia (CA)

Players can discuss any type of attack they think might be possible against the assessment target. It does not matter if the attack relates to another suit or any other card, but if possible try to identify an attack that is fairly unique to the application/functionality/users.

Scenario: Invent your own threat of any type

If an you can invent a completely new attack, the threats that arise depend on the impact of the attack. Since the attack is new, it may exploit weaknesses that were previously unknown, meaning the system may be unprepared to defend against it.

Depending on which type of attack you invent, you may be able to:

1. Create a novel way to impersonate users, services, or devices, bypassing authentication. Example: A new method to trick biometric sensors or generate valid authentication tokens.
2. Invent a new way to modify data, configurations, or code without detection. Example: Exploiting a logic flaw in a custom encryption routine to alter encrypted data unnoticed.
3. Create attacks that erase or falsify evidence of actions, preventing accountability. Example: A new way to manipulate logs or audit trails in real time.
4. Discover a novel method to access confidential or sensitive information. Example: Side-channel attacks that reveal cryptographic keys from memory or CPU timing.
5. A new technique to overwhelm or crash systems, processes, or networks. Example: Exploiting an unexpected protocol interaction to lock up servers.
6. Invent a method to gain higher privileges than intended. Example: Bypassing role-based access controls through unforeseen logical flaws in session handling.

Threat Modeling

STRIDE

To address truly unknown or novel threats that don't fit the STRIDE categories, use techniques like adversarial thinking, red teaming, and keeping up with emerging vulnerabilities to anticipate and prepare for these unforeseen risks in a comprehensive threat model.

What can go wrong?

Almost anything, You name it!

What are we going to do about it?

To address unknown threats, focus on a strong security mindset, continuous threat modeling and security testing, implement robust controls like "Defense in Depth", "Fail Safe", "Least Privilege", "Zero Trust" and other security principles and foster a culture of ongoing risk assessment and training. For further guidance see the OWASP Developer Guide.