Threat Modeling.

What is threat modeling?

Threat modeling is a way to think through how a system could be attacked, before it is attacked. The Threat Modeling Manifesto defines it as analyzing representations of a system to highlight concerns about security and privacy characteristics.

OWASP describes the work as identifying, communicating and understanding threats and mitigations within the context of protecting something of value. A mitigation is a step that reduces the effect of a threat.

How does threat modeling work?

Both OWASP and the Threat Modeling Manifesto organize the work around four questions.

• What are we working on?
• What can go wrong?
• What are we going to do about it?
• Did we do a good enough job?

OWASP says these questions can be answered in structured steps. First you assess the scope. Then you identify what could go wrong. Then you put countermeasures in place or manage the risk. Last, you check whether your security work is adequate for the system.

A simple illustration

This is a generic illustration, not a real case. A team draws a diagram of an application and the data it handles. For each part of the diagram, the team asks what could go wrong. It then writes down a countermeasure for each concern and later checks whether the countermeasures were enough.

What principles guide good threat modeling?

The Threat Modeling Manifesto lists values. It prefers a culture of finding and fixing design issues over checkbox compliance. It prefers people and collaboration over processes, methodologies and tools. It prefers continuous refinement over a single delivery, and doing threat modeling over talking about it.

Its principles include using threat modeling early and often to improve system security and privacy. They also say it should fit the way an organization builds systems and should give value to stakeholders. The manifesto adds that dialogue builds understanding, while documentation records it and makes it measurable.

What is data-centric threat modeling?

NIST Special Publication 800-154 is a draft guide on data-centric system threat modeling. NIST describes it as threat modeling that is focused on protecting particular types of data within systems. NIST says organizations can use it as part of their risk management processes. NIST says the approach models both the attack and the defense sides of protecting data. It is meant to set out basic principles for sound methods, not to replace existing methods.

Is threat modeling the same as a penetration test?

No. The manifesto defines threat modeling as analyzing representations of a system. A penetration test is a separate practice with its own entry. Related terms on this site include attack surface, tactics, techniques and procedures, and MITRE ATT&CK.

Is threat modeling done once?

The Threat Modeling Manifesto values a journey of understanding over a single snapshot, and continuous refinement over a single delivery. It describes threat modeling as something to do early and frequently.

Who takes part in threat modeling?

The manifesto puts people and collaboration over processes, methodologies and tools. Its principles say that dialog establishes shared understanding and that outcomes are meaningful when they provide value to stakeholders.