The process of modeling threats is planned process that aims to define security needs, identify security risks and vulnerabilities measure vulnerability and threat importance and prioritize remediation strategies.
Threat modeling techniques generate these artifacts
A abstract representation of the system
Potential attackers’ profiles such as their motives and tactics
A list of potential threats
Threat modeling identifies the kinds of threats that could cause damage to a computer or application system. It takes on the perspective of hackers who are malicious to determine the extent of damage they can cause. In the course of threat modeling, companies conduct an exhaustive analysis of the software architecture, the business context, and other documentation (e.g. specification of functions, and user manuals). This helps to gain a better understanding and discovery of key elements that affect the software. Typically, companies perform threat modeling at the design phase (but it may be conducted at different stages) of a brand new application to assist developers in identifying weaknesses and be more aware of the security consequences of their design, code, and configuration choices. Typically, developers conduct threat modeling using four steps:
Diagram. What do we want to build?
Find dangers. What is the possibility of a problem?
Mitigate. What can we do to protect ourselves from threats?
Validate. Did we take action in all the previous steps?
The advantages of threat modeling
If it is done properly when done correctly, threat modeling can give an easily visible view of the software development process and help justify security initiatives. The process of threat modeling aids an organization in identifying security risks to the application, and then make logical choices about how to deal with the threats. If not, decision-makers may act in a reckless manner based on little or insufficient evidence.
A well-documented threat model gives assurances that can be beneficial in explaining and protecting the security capabilities of a computer or application system. When the development company is committed to security threat modeling, it’s the most efficient method to achieve the following goals:
Find issues early during the software development lifecycle (SDLC)–even before the coding process begins.
Find design flaws that traditional tests and code reviews could overlook.
Consider new approaches to attack that you may not otherwise think of.
Maximize the budget for testing by assisting in the selection of testing targets or code revision.
Determine the security needs.
Fix issues prior to software release and avoid costly recoding after deployment.
Consider threats that go beyond the normal attacks, and think about security concerns specific for your particular application.
Be sure to keep your frameworks in front of external and internal attackers that are relevant to your application.
Use the highlighted assets, threats agents and controls to identify the components that attackers may be looking to attack.
Map the locations of threat actors, their motivations, abilities and capabilities to find possible attackers with respect to the architecture of the system.
The false notions about threat modeling
As a security procedure that is a security process, threat modeling can be subject to various misconceptions. Some believe that threat modeling is just an activity at the design stage, while others believe it is an option for an exercise that security testing, or code reviews could replace, and some believe that the process is too complex. This article should help to clarify some of these myths:
Code reviews and penetration testing cannot replace threat modeling. Testing for penetration and secure code review are two processes that can be effective in identifying flaws in code. However assessment of security (e.g. threat modelling) are better at revealing weaknesses in design.
There’s a reason to run an analysis of the threat following the deployment. Knowing the weaknesses with the current implementation can affect the the future strategy for security architecture and identifying weaknesses allows for quicker and more efficient correction. If you don’t know the risks the application faces and the risks it could face, you cannot be sure you’re dealing with all potential risks.
Threat modeling doesn’t need to be a lot of work. A lot of developers are intimidated by the thought that threat models are a part of their work. At first it could seem intimidating. However, if you break up the tasks into workable steps, performing a threat model on a simple web application–or even a complex architecture–becomes systematic. It is important to begin with the most basic best methods.
Best practices for threat modeling
The most effective application for threat analysis is the promotion of security knowledge across the entire team. It’s the first step towards making security a shared responsibility. In theory, threat modeling is a straightforward procedure. Consider these five guidelines for developing or revising the threat model:
1. Determine the scope and extent of the analysis. Establish the scope of analysis with the those who are involved, and then break down the analysis depth for the individual teams of developers so that they are able to threat to model the software.
2. Get a clear understanding of the threats you’re modeling. Draw a diagram of the most important component of the system (e.g. application server data warehouse thick client, database) and the relationships between the components.
3. Consider the possibilities of attack. Find out the security assets, software controls, as well as threat agents. Draw their locations to develop an identity model for the entire system (see Diagram 1). After you’ve modelled the system, it is possible to discern what could be wrong (i.e. dangers) with methods such as STRIDE.
4. Recognize the threats. To make a list of attacks that could be possible you should ask questions like the following:
Are there ways that the threat agent could get to an asset, without having to pass through the control?
Can a threat actor be able to thwart this security measure?
What should a threat-agent do to overcome this control?
5. Make a matrix of traceability that identifies inadequate or weak security measures. Think about the threats and follow their control routes. If you get to the software asset without having to go through a security safeguard this could signal a threat. If you pass through a security control, think about whether it could stop an agent of threat or the threat agent has methods to get around it.
Synopsys model of threat
Synopsys software security services offer threat modeling that can detect weaknesses that could increase the vulnerability of your system to attack, such as security-related design weaknesses, control oversights, or inconsistency, weakness or misuse.
It is Synopsys high-level approach
Synopsys’ Synopsys High-Level Approach to Threat Modeling is affixed with the steps below:
The system should be modelled.
Conduct an analysis of the threat.
Prioritize the dangers.
Model the system
Modeling of systems consists of two components:
Making a component diagram using the Control flow graph (which will show all possible execution routes within the course of executing a program)
Identifying assets, security controls trust zones, as well as the threat agents
Conduct a threat assessment
The most significant task involved in modeling threats is the identification of threats. The majority of methods can be classified into two groups:
Checklist-based approaches. A lot of threat modeling strategies use the use of a checklist or template. For instance, STRIDE recommends you consider the following types of threats: spoofing manipulation, repudiation, disclosure and denial of service and escalation of privilege for every data flow that crosses the boundary of trust.
Non-checklist-based approaches. These strategies typically employ innovative methods (e.g. brainstorming, for instance) to spot threats.
Synopsys threat analysis employs an approach similar to a checklist using an outline to guide the main analysis, yet allows for the possibility of creative analysis. Synopsys utilizes pre-baked application protocols for threat analysis that is commonly applied to applications-level protocols like OAuth, SAML, OIDC, Kerberos, password-based authentication and many more. This list isn’t exhaustive however it can help users to think about the areas you need to study.
Prioritizing dangers
After we’ve modelled the system and perform a threat analysis We’ve compiled an inventory of potential threats. It’s now time to decide which ones to prioritize. At Synopsys we employ the NIST method to rank threats. We use guidelines to quantify the probability and impact of every threat in order to determine its severity.
Menu