• Journal of Internet Computing and Services
    ISSN 2287 - 1136 (Online) / ISSN 1598 - 0170 (Print)
    https://jics.or.kr/
Menu

Analyze Virtual Private Network Vulnerabilities and Derive Security Guidelines Based on STRIDE Threat Modeling


Da-hyeon Kim, Ji-young Min, Jun-ho Ahn, Journal of Internet Computing and Services, Vol. 23, No. 6, pp. 27-37, Dec. 2022
10.7472/jksii.2022.23.6.27, Full Text:  HTML
Keywords: Virtual Private Network, STRIDE Threat Modeling, Threat Analysis, Threat Scenario, Security requirement

Abstract

Virtual private network (VPN) services are used in various environments related to national security, such as defense companies and defense-related institutions where digital communication environment technologies are diversified and access to network use is increasing. However, the number of cyber attacks that target vulnerable points of the VPN has annually increased through technological advancement. Thus, this study identified security requirements by performing STRIDE threat modeling to prevent potential and new vulnerable points that can occur in the VPN. STRIDE threat modeling classifies threats into six categories to systematically identify threats. To apply the proposed security requirements, this study analyzed functions of the VPN and formed a data flow diagram in the VPN service process. Then, it collected threats that can take place in the VPN and analyzed the STRIDE threat model based on data of the collected threats. The data flow diagram in the VPN service process, which was established by this study, included 96 STRIDE threats. This study formed a threat scenario to analyze attack routes of the classified threats and derived 30 security requirements for each element of the VPN based on the formed scenario. This study has significance in that it presented a security guideline for enhancing security stability of the VPN used in facilities that require high-level security, such as the Ministry of National Defense (MND).


Statistics
Show / Hide Statistics

Statistics (Past 3 Years)
Multiple requests among the same browser session are counted as one view.
If you mouse over a chart, the values of data points will be shown.


Cite this article
[APA Style]
Kim, D., Min, J., & Ahn, J. (2022). Analyze Virtual Private Network Vulnerabilities and Derive Security Guidelines Based on STRIDE Threat Modeling. Journal of Internet Computing and Services, 23(6), 27-37. DOI: 10.7472/jksii.2022.23.6.27.

[IEEE Style]
D. Kim, J. Min, J. Ahn, "Analyze Virtual Private Network Vulnerabilities and Derive Security Guidelines Based on STRIDE Threat Modeling," Journal of Internet Computing and Services, vol. 23, no. 6, pp. 27-37, 2022. DOI: 10.7472/jksii.2022.23.6.27.

[ACM Style]
Da-hyeon Kim, Ji-young Min, and Jun-ho Ahn. 2022. Analyze Virtual Private Network Vulnerabilities and Derive Security Guidelines Based on STRIDE Threat Modeling. Journal of Internet Computing and Services, 23, 6, (2022), 27-37. DOI: 10.7472/jksii.2022.23.6.27.