Modeling Threats: Strategies in Threat Modeling

Here we'll describe the various methods of performing threat models, primarily emphasizing the manual approach. The manual threat modeling process includes decomposition of applications, identification and ranking of threats, understanding assets and trust levels, categorizing threats, and determining countermeasures and mitigations. It also highlights a more structured approach involving attack scenarios and building threats based on attacker interactions, contrasting it with the manual threat modeling process.

Here we'll delve into various types of threat modeling, emphasizing manual versus tool-driven approaches and exploring other methods like automatic, formal, and graphical threat models. We'll highlight the advantages and challenges of each approach, such as the quality and scalability of manual versus tool-driven models, the rapid identification of vulnerabilities in automatic models, the rigor and mathematical precision of formal models, and the visual simplicity and communicative power of graphical models.

The section introduces STRIDE as a threat modeling technique, developed by Microsoft, utilizing an acronym that stands for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privileges. It delves into the meanings of each term, outlining the threats they represent. It explains the process of applying STRIDE, starting with drawing out the system's architecture, identifying the "who," "what," "why," "how," "impact," and "countermeasures," and categorizing potential threats using the STRIDE acronym. The section also offers an example scenario involving a cyber criminal gang targeting credit information, detailing their motives, methods, potential impact, and proposed countermeasures, such as implementing two-factor authentication.

DREAD, a threat modeling technique by Microsoft, stands for Damage, Reproducibility, Exploitability, Affected users, and Discoverability. It's a structured approach for assessing potential risks and impacts of identified threats and vulnerabilities. Each element of DREAD quantifies specific aspects: Damage gauges potential harm, Reproducibility assesses threat consistency, Exploitability measures the ease of vulnerability exploitation, Affected users consider the number impacted, and Discoverability evaluates how easily a threat can be found. Using a scale from zero to ten, DREAD numerically scores each factor, aiding in risk quantification and prioritization.

The MITRE ATT&CK framework is a robust knowledge base detailing cyber adversaries' tactics, techniques, and procedures (TTPs) used throughout various stages of a cyber attack. Its components span tactics, techniques, procedures, threat actor groups, data sources, mitigations, and more. This framework enables a comprehensive understanding of adversarial behavior, aiding in threat detection, analysis, and prevention within cybersecurity.

In this section, other advanced threat modeling techniques offer diverse approaches to comprehensive threat modeling, combining various methodologies to evaluate and mitigate security threats.

This segment explores the integration of threat modeling within the software development life cycle (SDLC). It emphasizes the concept of defense in depth, where security measures are layered across the technology stack, from network edges to applications and data. It delves into the benefits of incorporating threat modeling early in the SDLC, highlighting its role in understanding architecture, contributing to penetration testing, code reviews, and risk management.

This section introduces attack trees as a graphical tool for modeling threats within a system. It explains their purpose, offering a user-friendly approach to understanding potential attack paths and enabling the formulation of preventive measures. Attack trees are depicted as hierarchical structures that start with a specific malicious activity or objective and break down into sub-goals, tactics, and strategies employed by attackers. The visual representation aids in analyzing and communicating security risks and vulnerabilities within a system, with each node or leaf representing specific elements of an attack.

This section focuses on a practical activity involving the use of Deciduous, an attack tree building interface. It explains the core components of an attack tree in deciduous, outlining their specific functions within the interface.

This segment delves into the concept of continuous threat modeling, focusing on integrating the process of identifying and mitigating security threats into the software development lifecycle (SDLC) at every incremental change.

This segment discusses Threagile, a tool employed in continuous threat modeling, particularly within CI/CD pipelines. The process involves creating a YAML file, inputting it into Threagile, and then generating a report outlining the threats to the architecture described in the YAML file.

This section delves into threat modeling in the context of cloud environments, emphasizing the differences and unique considerations compared to traditional threat modeling.

This module delves into the prioritization and management of identified threats within a system through various risk assessment methodologies. It covers techniques to assess threat severity, potential impact, and likelihood of occurrence. The module highlights models like the Factor Analysis of Information Risk (FAIR), the Open Web Application Security Project (OWASP) risk rating methodology, and the Center for Internet Security Risk Assessment Method (CIS RAM).

This module explores the critical strategies employed to mitigate risks in the ever-evolving cybersecurity landscape. Learners delve into identified threats and vulnerabilities, discovering comprehensive plans and leveraging established frameworks to address these risks effectively. Emphasizing key principles, the module sheds light on minimizing attack surfaces, adopting least privilege principles, and implementing defense in depth strategies.

Within this module, we delved into the various types of controls used in cybersecurity to counteract identified threats. These controls fall into several categories: preventive, deterrent, detective, corrective, recovery, compensating, and access control. Each type of control serves a distinct purpose, such as preventing incidents, deterring unauthorized access, detecting breaches, correcting system errors, recovering from incidents, compensating for primary controls, and managing access to systems and facilities.

This module delves into the crucial phase of validating and testing security controls. It covers the importance of testing for control effectiveness, highlighting methods like simulation, penetration testing, and standards validation.

This section provides a practical demonstration of a threat modeling exercise within a financial institution's online banking system. It details the identification of critical assets like customer data and financial transactions, along with potential threats such as phishing attacks, data breaches, and insider threats.

This segment dives into a live demonstration of using Deciduous, an attack tree interface. It revisits a previous example of compromising a privileged account within Deciduous but extends it by showcasing the addition of an extra mitigation and potential attack scenario.

In this tutorial, Threagile, a tool for threat modeling, is utilized to create a threat model for a fictional healthcare application. The process involves using a YAML file that encapsulates various aspects of the application, including its business and technical overview, security-related questions for the development team, abuse cases, security requirements, technical assets, trust boundaries, and more.

Here we'll take a quick trip around OWASP Threat Dragon and learn how to create a threat model using the tool.

Microsoft threat model is a free tool that can be used to draw an architecture diagram and generate threats based on that diagram. Here we will walk through a quick demo of using Threat Model

OWASP Risk Rating is a method that is used to assign a numeric value to risks that have been identified by the organization. This allows them to help prioritize the risk mitigation/remediation based on the impact that the risk has. Here we'll walk through a simple example of using OWASP Risk Rating.