Appearance
Cirius Group Threat Model 2026
Superseded (DOCS-145). This 2026 executive summary is consolidated into the Cirius Group Threat Model, now the single canonical reference (crown jewels, actors, STRIDE, controls, residual risk). Kept for history — do not update; edit the canonical doc instead.
Purpose: Executive summary of the 2026 Cirius Group threat model. Intended for review by the Security Officer, leadership, and external auditors (SOC2 September 2026). Links the crown jewel inventory, threat actor profiles, STRIDE analysis, and controls mapping into a single narrative with explicit residual risks and a prioritized recommendation set.
Owner: Rory (Security Officer) Audience: Leadership, Security Officer, SOC2 auditor Review frequency: Annual in December; triggered mid-cycle by material incident or material environment change (see runbooks/monthly-security-review.md for the annual trigger) Last reviewed: April 2026
1. Executive summary
Cirius Group operates two Azure tenants (PROD ciriusgroup.com, DDE ciriusdde.com) plus a seven-account AWS organization serving DR and backup. The business handles PHI on behalf of healthcare customers, and the DDE environment hosts a customer-facing published application for Medicare. In November 2024 the environment experienced a ransomware attack that serves as both a historical lesson and the benchmark for the current threat model.
The threat model concludes:
- The highest-likelihood, highest-impact actor remains ransomware-as-a-service affiliates operating on the credential-spray → lateral movement → encryption pattern. A repeat of the November 2024 pattern is the most probable serious event we will face.
- The highest-value crown jewels are the Active Directory forests (including KRBTGT), the Palo Alto Panorama fabric, and PHI in SharePoint and psql-secops-prod. Veeam backups are a secondary crown jewel because ransomware actors specifically target backup infrastructure.
- Preventive control coverage is strong across all kill chain stages (Conditional Access, Palo Alto + DNS Security, Cortex XDR, Arctic Wolf MDR, Twingate ZTA, immutable backups).
- Detective control coverage has clear gaps at stages 2–7 of the kill chain — specifically execution, persistence, credential dumping, lateral movement, exfiltration, and defense evasion. These gaps are all under active remediation as the kill-chain workstream (CLAUDE.md priorities #2 and #3).
- Residual risks that require formal acceptance through September 2026 are documented in
compliance/risk-acceptance-register.md(FIDO2 deployment, IR retainer).
By the September 2026 SOC2 audit window, with the kill-chain workstream complete and the FIDO2 rollout deployed, residual risk should drop from its current MEDIUM-HIGH posture to LOW-MEDIUM across all crown jewels.
2. Scope
In scope
- Azure PROD tenant and subscription infrastructure
- Azure DDE tenant, subscription, and customer-facing published app
- AWS 7-account organization (Management, Backup, Dev, Identity, Logging, Networking, Prod)
- SecOps platform (ca-secops-prod, psql-secops-prod) and the 17 security monitoring agents
- SharePoint / M365 as a PHI store
- Identity fabric (Entra ID, on-prem AD forests)
- Network fabric (4 Palo Alto VM-Series + Panorama, Twingate, DNS Security)
- Endpoint fabric (Cortex XDR, Intune, Arctic Wolf, Keeper Security)
- Backup fabric (Veeam, Recovery Services Vaults, S3 Object Lock)
Out of scope (addressed by vendor attestations)
- Microsoft's internal security for Azure, M365, Azure OpenAI (covered by MBSA + SOC2 Type II)
- AWS's internal security (covered by AWS HIPAA agreement + SOC2 Type II)
- Palo Alto / Cortex / Arctic Wolf / Keeper / Twingate internal controls (vendor SOC2 reports on file per
compliance/vendor-risk-inventory.md)
3. Crown jewels
Summarized from crown-jewels.md. Full detail including blast radius and existing controls in that document.
| ID | Asset | Category | Blast radius if compromised |
|---|---|---|---|
| CJ-1 | psql-secops-prod | PHI concentration | Incident/evidence trail integrity; references to PHI |
| CJ-2 | SharePoint PHI | PHI concentration | Unknown-volume PHI in files; exfiltration primary risk |
| CJ-3 | AD forests | Identity authority | Domain-wide privilege, DCSync enables Golden Ticket |
| CJ-4 | Palo Alto Panorama | Network authority | Full network visibility + policy control |
| CJ-5 | KRBTGT | Key material | Kerberos Golden Ticket until 2x rotation |
| CJ-6 | Break-glass accounts | Identity (emergency) | Highest privilege in trust boundary |
| CJ-7 | Azure Key Vaults | Key material | Decrypts data at rest; app secrets |
| CJ-8 | Veeam backups | Recovery authority | Blocks ransomware recovery |
4. Threat actors
Summarized from threat-actors.md.
| Actor | Likelihood | Impact | Primary targets |
|---|---|---|---|
| RaaS affiliate | HIGH | CRITICAL | AD, KRBTGT, Veeam |
| Healthcare data thief / fraudster | MEDIUM-HIGH | CRITICAL | SharePoint PHI, OAuth apps |
| Nation-state | LOW | CRITICAL | Supply chain, identity fabric |
| Insider | LOW-MEDIUM | HIGH-CRITICAL | Role-dependent |
5. Attack chains — representative paths
Each chain is an ordered sequence of stages that an attacker would execute to reach a crown jewel. Detection and prevention gates appear where they occur.
Chain A — Ransomware (RaaS affiliate, Nov 2024 pattern)
- Initial Access — Credential spray against Entra, hits a service account excluded from MFA
- Execution — Beacon binary dropped to
%APPDATA%\Local\Temp - Credential Access — LSASS dump on pivot host; DCSync against DC
- Lateral Movement — Pass-the-Hash / RDP to high-value machines
- Defense Evasion — Clear Security log (EventID 1102); attempt Cortex tamper
- Impact — Ransomware deploys via GPO scheduled task, encrypts 60+ VMs, Veeam targeted for deletion
Each stage maps to controls in controls-mapping.md. Stages 2, 4 have the largest active detection gaps.
Chain B — Data theft (fraudster)
- Initial Access — AiTM phishing kit harvests credentials + session cookie
- Persistence — Register malicious OAuth app with Graph offline_access scope
- Credential Access — Refresh token abuse bypasses password rotation
- Discovery — Graph API enumerates SharePoint PHI libraries
- Exfiltration — Slow-and-low document pull over days
Stage 5 is the key detection bet — UBA + Graph API anomaly detection. Agent in build.
Chain C — Nation-state supply chain (hypothetical)
- Initial Access — Trusted vendor software update contains implant (SolarWinds-class)
- Execution — Implant runs under trusted process
- Persistence — Stays dormant for weeks
- Credential Access — Harvests keys slowly
- Impact — Actioning on objective might be data theft or positioning for future operation
Detection relies heavily on vendor telemetry (Arctic Wolf) and SHA-pinning of supply chain.
Chain D — Insider (disgruntled engineer)
- Initial Access — Legitimate session on last day of employment
- Discovery — Knows exactly where PHI is
- Exfiltration — Bulk SharePoint download, or database export
- Impact — Data sold, sent to competitor, or published
Detection via DLP + UBA + monthly Keeper session review. Termination runbook SLA (4h) is the primary preventive control.
6. Residual risks
| Risk | Current state | Target | Tracking |
|---|---|---|---|
| DCSync detection (CJ-3, CJ-5) | PARTIAL | Full coverage via 4662 SACL agent | compliance scorecard row 50 |
| FIDO2 phishing-resistant MFA | IN_PROGRESS | Deployed for all privileged accounts | risk-acceptance-register.md RA-2026-001 |
| IR retainer | GAP | Executed by Q3 2026 | risk-acceptance-register.md RA-2026-002 |
| FIM coverage for ransomware paths | IN_PROGRESS | Verified scope and paths | compliance scorecard row 49 |
| Kill-chain agents (exec, persist, cred, lat, exfil) | IN_PROGRESS | Deployed and tuned | compliance scorecard row 50 |
| Cortex silence escalation | NOT STARTED | Implemented as correlation rule | "This month" priority item |
| pgaudit on psql-secops-prod | IN_PROGRESS | Enabled + DCR to LAW | compliance scorecard row 51 |
| BAA backlog (4 vendors) | IN_PROGRESS | All IN_FORCE | vendor-risk-inventory.md |
7. Recommendations (prioritized)
- Complete kill-chain Phase 1 + Phase 2 (already #2 and #3 on the priority list). This closes detection gaps at stages 2–7 and is the single highest-leverage investment we can make this year.
- Deploy FIDO2 for all privileged accounts by Q3. AiTM-resistant auth eliminates the credential-phishing vector against our most valuable identities.
- Execute IR retainer before SOC2 audit (September). Evaluation already in flight; sign and test by end of Q3.
- Enable pgaudit on psql-secops-prod in Q2. Closes CJ-1 tampering/repudiation gap.
- Verify FIM coverage and paths as part of Q2 kill-chain work. Tighten ransomware-stage detection.
- Q2 DR test will validate Veeam vs RSV vs S3 independence for CJ-8 under realistic conditions.
- Q2 tabletop runs the Chain A scenario end-to-end (see
compliance/ir-tabletop-scenario-2026.md). Produce findings before the live DR test so lessons inform both. - Close the BAA backlog (Arctic Wolf, Keeper, Twingate, Cortex) before September audit.
8. Links and cross-references
- Crown jewels:
security/threat-model/crown-jewels.md - Threat actors:
security/threat-model/threat-actors.md - STRIDE analysis:
security/threat-model/stride-analysis.md - Controls mapping:
security/threat-model/controls-mapping.md - Compliance scorecard:
compliance/compliance-scorecard.md - Risk acceptance register:
compliance/risk-acceptance-register.md - Incident response runbook:
runbooks/incident-response.md - Ransomware tabletop scenario:
compliance/ir-tabletop-scenario-2026.md - Q2 DR test plan:
compliance/q2-dr-test-plan-2026.md - Q4 DR test plan:
compliance/q4-dr-test-plan-2026.md - Monthly security review (annual trigger for this doc):
runbooks/monthly-security-review.md
Document history
| Date | Change | Author |
|---|---|---|
| April 2026 | Initial 2026 threat model summary | Kobe |