Threat modeling Flashcards
What is threat modeling?
Looking at the vulnerability landscape of a system, and ways to attacks it.
Look at a system from an adversary’s perspective to anticipate attack goals.
Why do we use threat modeling? (4)
Understand and document a system’s threat environment
Discover weaknesses
How to spend the security budget
To retrospect - How was my system attacked
Name a principle in threat modeling?
The outcomes of threat modeling are meaningful when they are of value to stakeholders
When in the trustworthy computing security development lifecycle does threat modelling happen?
Security training
Security kickoff & register with SWI
Security design best practices
Security architecture & attack surface review
[Threat modeling]
What is the flow of agile threat modeling?
Project inception: Look at high level threats
Requirements planning: Threats with highest impact
Sprint planning: Where are the threats
Sprint execution: Develop, update and complete
Final release planning: Complete models
What are important principles in agile threat modeling?
Continuous refinement over a single delivery
Early and frequent analysis
Must align with an organization’s development practices
What 4 key questions are asked when doing threat modeling?
- What are we working on?
- What can go wrong?
- What are we going to do about it?
- Did we do a good enough job?
What is the output of threat modeling?
Known threats to a system
What do we use the result of threat modeling to?
The result informs decisions that you might make in subsequent design, development, testing and post-deployment phases.
What two guidelines does the threat model manifesto identify?
Values
Principles
What are a value in threat modeling?
Something that has relative worth or importance.
What are principles in threat modeling?
Describes the fundamental truths of threat modeling.
What are the 3 types of principles in threat modeling?
- Fundamental, primary, or general truths that enable successful threat modeling
- Patterns that are highly recommended
- Anti-patterns that should be voided
Name 5 values in threat modeling
A culture of finding and fixing design issues over checkbox compliance
People and collaboration over processes, methodologies and tools
A journey of understanding over a security or privacy snapshot
Doing threat modeling over talking about it
Continuous refinement over a single delivery
Name 4 principles of threat modeling
Frequent and early analysis to Improve the security and privacy of a system
Align with an organization’s development practices and follow design changes in iterations that are each scoped to manageable portions of the system
Outcomes are meaningful when they are of value to stakeholders
Dialog is key to establishing the common understandings, while documents record those understandings and enable measurement
Name 5 patterns that benefit threat modeling
Systematic approach
Informed creativity
Varied viewpoints
Useful toolkit
Theory into practice
Describe the pattern: Systematic approach
Apply security and privacy knowledge in a structured manner
Describe the pattern: Informed creativity
Allow for creativity by including both craft and science
Describe the pattern: Varied viewpoints
Diverse team with appropriate subject matter experts
Cross-functional collaboration
Describe the pattern: Useful toolkit
Use tools that:
- increase productivity
- enhance workflows
- enable repeatability
- provide measurability
Describe the pattern: Theory into practice
Use field-tested techniques and be informed of the benefits and limits of these
Name 4 anti-patterns that inhibit threat modeling
Hero threat modeller
Admiration for the problem
Tendency to overfocus
Perfect representation
What is the anti-pattern: Hero threat modeller
Threat modeling does not depend on one’s innate ability or unique mindset; everyone can and should do it
What is the anti-pattern: Admiration for the problem
Go beyond just analyzing the problem; reach for practical and relevant solutions
