MD4 Threat Modelling: A proactive approach to security

Question 1

Threat Modelling

Answer 1

Threat modeling is a process of identifying assets, their vulnerabilities, and how each is exposed to threats. We apply threat modeling to everything we protect. Entire systems, applications, or business processes all get examined from this security-related perspective.

Creating threat models is a lengthy and detailed activity. They’re normally performed by a collection of individuals with years of experience in the field. Because of that, it’s considered to be an advanced skill in security. However, that doesn’t mean you won’t be involved.

Question 2

Threat modeling frameworks

Answer 2

There are several threat modeling frameworks used in the field. Some are better suited for network security. Others are better for things like information security, or application development.

In general, there are six steps of a threat model. The first is to define the scope of the model. At this stage, the team determines what they’re building by creating an inventory of assets and classifying them.

Question 3

6 steps in threat modelling

1. Scope of model

Answer 3

The first is to define the scope of the model. At this stage, the team determines what they’re building by creating an inventory of assets and classifying them.

Question 4

6 steps in threat modelling

2. Identify threats

Answer 4

The second step is to identify threats. Here, the team defines all potential threat actors. A threat actor is any person or group who presents a security risk. Threat actors are characterized as being internal or external. For example, an internal threat actor could be an employee who intentionally expose an asset to harm. An example of an external threat actor could be a malicious hacker, or a competing business.

Attack Tree:

After threat actors have been identified, the team puts together what’s known as an attack tree. An attack tree is a diagram that maps threats to assets. The team tries to be as detailed as possible when constructing this diagram before moving on.

Question 5

6 steps in threat modelling

3. Characterise the environment

Answer 5

Step three of the threat modeling process is to characterize the environment. Here, the team applies an attacker mindset to the business. They consider how the customers and employees interact with the environment. Other factors they consider are external partners and third party vendors.

Question 6

6 steps in threat modelling

4. Analyse Threats

Answer 6

At step four, their objective is to analyze threats. Here, the team works together to examine existing protections and identify gaps. They then rank threats according to their risk score that they assign.

Question 7

6 steps in threat modelling

5. Mitigate risk

Answer 7

During step five, the team decides how to mitigate risk. At this point, the group creates their plan for defending against threats. The choices here are to avoid risk, transfer it, reduce it, or accept it.

Question 8

6 steps in threat modelling

6. Evaluate findings

Answer 8

The sixth and final step is to evaluate findings. At this stage, everything that was done during the exercise is documented, fixes are applied, and the team makes note of any successes they had. They also record any lessons learned, so they can inform how they approach future threat models.

This is one of many methods that exist