Pemodelan Ancaman Stride/Dread Pada Sistem Diseminasi Terintegrasi

Harry Kartono; Ruki Harwahyu

doi:10.30591/smartcomp.v12i4.5698

Pemodelan Ancaman Stride/Dread Pada Sistem Diseminasi Terintegrasi

Harry Kartono, Ruki Harwahyu

Abstract

Implementasi sistem yang terintegrasi seperti SDT (Sistem Diseminasi Terintegrasi) memudahkan pengguna untuk menyelesaikan pekerjaan yang sudah ada . Sistem yang terintegrasi juga membuat proses bisnis semakin cepat , efisien dan terotomasi karena adanya tukar data antar mesin . Tetapi dengan integrasinya beberapa sistem menjadi satu sistem besar maka rumit suatu sistem akan bertambah dan juga ancaman juga semakin banyak . Pemodelan ancaman adalah suatu metodologi untuk kebaikan suatu ancaman , penisian risiko , dan langkah penanggulangan agar ancaman yang timbul tidak mengganggu suatu proses bisnis dalam sistem . Pemodelan ancaman pada SDT ini memiliki beberapa tahap , tahap awal adalah dekomposisi sistem-sistem penyusun SDT, integrasi komponen antar sistem , klasifikasi ancaman berdasarkan STRIDE, penilian risiko berdasarkan DREAD, dan pemilihan perbaikan tiap kelompok komponen . Tahapan-tahapan ini menghasilkan klasifikasi ancaman , serta penisian risiko tiap komponen pada sistem-sistem di SDT. Komponen yang paling banyak ancaman dan paling berisiko terhadap ancaman adalah komponen Webserver Mediator, Webserver Diseminasi dan Webserver Portalpublikasi . Ancaman tertinggi pada tiga komponen di tersebut adalah peningkatan keistimewaan. Dari hasil klasifikasi ancaman dan penilian risiko maka ditentukan langkah pengaturan pada komponen ketiga Webserver untuk meminimalkan potensi ancaman

Full Text:

References

A. Hanelt, R. Bohnsack, D. Marz, and C. Antunes Marante, ‘A Systematic Review of the Literature on Digital Transformation: Insights and Implications for Strategy and Organizational Change’, Journal of Management Studies, vol. 58, no. 5, pp. 1159–1197, Jul. 2021, doi: 10.1111/JOMS.12639.

A. Abugabah, L. Sanzogni, and A. Poropat, ‘The impact of information systems on user performance: A critical review and theoretical model’, 2009. [Online]. Available: https://www.researchgate.net/publication/45109460

C. Tam, A. Loureiro, and T. Oliveira, ‘The individual performance outcome behind e-commerce Integrating information systems success and overall trust’, 2020, doi: 10.1108/INTR-06-2018-0262.

R. Lawan, ‘Why you need to integrate Information Systems in your business’. https://www.linkedin.com/pulse/why-you-need-integrate-information-systems-your-business-lawan (accessed Feb. 09, 2023).

C.-C. Osman, ‘Robotic Process Automation: Lessons Learned from Case Studies’, Informatica Economica, vol. 23, no. 4/2019, pp. 66–71, Dec. 2019, doi: 10.12948/ISSN14531305/23.4.2019.06.

F. Yahya, B. M. Fazli, M. F. Abdullah, and H. Zulkifli, ‘Extending the national lake database of Malaysia (MyLake) as a central data exchange using big data integration’, ACM International Conference Proceeding Series, pp. 30–35, Jul. 2019, doi: 10.1145/3352411.3352417.

L. A. Al-Juboori and A. A. Duroobi, ‘CAD/CAM integration verification process based on data exchange method on free form surfaces’, 2020 Advances in Science and Engineering Technology International Conferences, ASET 2020, vol. 2020-January, Feb. 2020, doi: 10.1109/ASET48392.2020.9171372.

A. Luder, K. Kirchheim, J. Pauly, S. Biffl, F. Rinker, and L. Waltersdorfer, ‘Supporting the data model integrator in an engineering network by automating data integration’, IEEE International Conference on Industrial Informatics (INDIN), vol. 2019-July, pp. 1229–1234, Jul. 2019, doi: 10.1109/INDIN41052.2019.8972174.

L. Garber, ‘The challenges of securing the virtualized environment’, Computer (Long Beach Calif), vol. 45, no. 1, pp. 17–20, Jan. 2012, doi: 10.1109/MC.2012.27.

T. Subatri, Konsep Sistem Informasi. Andy Publisher, 2012.

Victoria Drake, ‘Threat Modeling | OWASP Foundation’. https://owasp.org/www-community/Threat_Modeling (accessed Feb. 04, 2023).

M. Aminzade, ‘Confidentiality, integrity and availability – finding a balanced IT framework’, Network Security, vol. 2018, no. 5, pp. 9–11, May 2018, doi: 10.1016/S1353-4858(18)30043-6.

R. Goel, A. Kumar, and J. Haddow, ‘PRISM: a strategic decision framework for cybersecurity risk assessment’, Information and Computer Security, vol. 28, no. 4, pp. 591–625, Oct. 2020, doi: 10.1108/ICS-11-2018-0131/FULL/PDF.

M. S. Ferdous, S. Chowdhury, and J. M. Jose, ‘Privacy threat model in lifelogging’, UbiComp 2016 Adjunct - Proceedings of the 2016 ACM International Joint Conference on Pervasive and Ubiquitous Computing, pp. 576–581, Sep. 2016, doi: 10.1145/2968219.2968324.

M. G. Jaatun, K. Bernsmed, D. S. Cruzes, and I. A. Tøndel, ‘Threat modeling in agile software development’, Exploring Security in Software Architecture and Design, pp. 1–14, Jan. 2019, doi: 10.4018/978-1-5225-6313-6.CH001.

T. Omitola, A. Rezazadeh, and M. Butler, ‘Making (Implicit) security requirements explicit for cyber-physical systems: A maritime use case security analysis’, Communications in Computer and Information Science, vol. 1062, pp. 75–84, 2019, doi: 10.1007/978-3-030-27684-3_11/COVER.

D. Ha, S. Upadhyaya, H. Ngo, S. Pramanhik, R. Chinchani, and S. Mathew, ‘Insider threat analysis using information-centric modeling’, IFIP International Federation for Information Processing, vol. 242, pp. 55–73, 2007, doi: 10.1007/978-0-387-73742-3_4/COVER.

‘Threats - Microsoft Threat Modeling Tool - Azure | Microsoft Learn’. https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-threats (accessed Feb. 09, 2023).

J. Straub, ‘Modeling Attack, Defense and Threat Trees and the Cyber Kill Chain, ATTCK and STRIDE Frameworks as Blackboard Architecture Networks’, in Proceedings - 2020 IEEE International Conference on Smart Cloud, SmartCloud 2020, Institute of Electrical and Electronics Engineers Inc., Nov. 2020, pp. 148–153. doi: 10.1109/SmartCloud49737.2020.00035.

‘Threat modeling for drivers - Windows drivers | Microsoft Learn’. https://learn.microsoft.com/en-us/windows-hardware/drivers/driversecurity/threat-modeling-for-drivers (accessed Feb. 10, 2023).

DOI: https://doi.org/10.30591/smartcomp.v12i4.5698