High Level Threat Model

Tweet

 

High Level Threat Model

Software Security Engineering Blog III

Written by Maheshwar Kanitkar and Hemant Belorkar

A threat model is essentially a structured representation of all the information that affects the security of an application. In essence, it is a view of the application and its environment with a  security mindset.

Threat modeling is a process for capturing, organizing, and analyzing all of this information. Threat modeling enables informed decision-making about application security risk. In addition to producing a model, typical threat modeling efforts also produce a prioritized list of security improvements to the concept, requirements, design, or implementation.

Threat Modeling - Generic Steps

• Define the application requirements.
• Security-based risk assessments to identify areas of greatest risk to the business and the technology platform were completed.
• Identify user roles that will interact with the application.
• Identify the data the application will manipulate.
• Identify the use cases for operating on that data that the application will facilitate.
• Findings from the risk assessments were addressed in the security architecture and implementation.
• Model the components of the application.
• Model the service roles that the components will act under.
• Model any external dependencies.
• Model the calls from roles, to components and eventually to the data store for each use case
• Identify any threats to the confidentiality, availability and integrity of the data and the        application based on the data access control matrix that your application should be enforcing.
• Assign risk values and determine the risk responses.
• Determine the counter measures to implement based on your chosen risk responses.
• Continually update the threat model based on the emerging security landscape.

One can build a threat model using STRIDE, an acronym for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.

Benefits

Done right, threat modeling provides a clear "line of sight" across a project that justifies security efforts. The threat model allows security decisions to be made rationally, with all the information on the table. The alternative is to make knee-jerk security decisions with no support. The threat modeling process naturally produces an assurance argument that can be used to explain and defend the security of an application. An assurance argument starts with a few high level claims, and justifies them with either sub claims or evidence.