Threat modeling is a process by which potential threats, such as
structural vulnerabilities or the absence of appropriate safeguards, can be identified and enumerated, and countermeasures prioritized.
The purpose of threat modeling is to provide defenders with a systematic analysis of what controls or defenses need to be included, given the nature of the system, the probable attacker's profile, the most likely attack vectors, and the assets most desired by an attacker. Threat modeling answers questions like ''“Where am I most vulnerable to attack?”'', ''“What are the most relevant threats?”'', and ''“What do I need to do to safeguard against these threats?”''.
Conceptually, most people incorporate some form of threat modeling in their daily life and don't even realize it. Commuters use threat modeling to consider what might go wrong during the morning journey to work and to take preemptive action to avoid possible accidents. Children engage in threat modeling when determining the best path toward an intended goal while avoiding the playground bully. In a more formal sense, threat modeling has been used to prioritize military defensive preparations since antiquity.
Evolution of IT-based threat modeling
Shortly after shared computing made its debut in the early 1960s individuals began seeking ways to exploit security vulnerabilities for personal gain. As a result, engineers and computer scientists soon began developing threat modeling concepts for information technology systems.
Early IT-based threat modeling methodologies were based on the concept of architectural patterns first presented by
Christopher Alexander
Christopher Wolfgang John Alexander (4 October 1936 – 17 March 2022) was an Austrian-born British-American architect and design theorist. He was an emeritus professor at the University of California, Berkeley. His theories about the nature o ...
in 1977. In 1988 Robert Barnard developed and successfully applied the first profile for an IT-system attacker.
In 1994, Edward Amoroso put forth the concept of a “threat tree” in his book, “Fundamentals of Computer Security Technology.” The concept of a threat tree was based on decision tree diagrams. Threat trees graphically represent how a potential threat to an IT system can be exploited.
Independently, similar work was conducted by the
NSA
The National Security Agency (NSA) is a national-level intelligence agency of the United States Department of Defense, under the authority of the Director of National Intelligence (DNI). The NSA is responsible for global monitoring, collecti ...
and
DARPA
The Defense Advanced Research Projects Agency (DARPA) is a research and development agency of the United States Department of Defense responsible for the development of emerging technologies for use by the military.
Originally known as the Adv ...
on a structured graphical representation of how specific attacks against IT-systems could be executed. The resulting representation was called “
attack tree
Attack trees are conceptual diagrams showing how an asset, or target, might be attacked. Attack trees have been used in a variety of applications. In the field of information technology, they have been used to describe threats on computer syste ...
s.” In 1998
Bruce Schneier
Bruce Schneier (; born January 15, 1963) is an American cryptographer, computer security professional, privacy specialist, and writer. Schneier is a Lecturer in Public Policy at the Harvard Kennedy School and a Fellow at the Berkman Klein Cente ...
published his analysis of cyber risks utilizing attack trees in his paper entitled “Toward a Secure System Engineering Methodology.” The paper proved to be a seminal contribution in the evolution of threat modeling for IT-systems. In Schneier's analysis, the attacker's goal is represented as a “root node,” with the potential means of reaching the goal represented as “leaf nodes.” Utilizing the attack tree in this way allowed cybersecurity professionals to systematically consider multiple attack vectors against any defined target.
In 1999, Microsoft cybersecurity professionals Loren Kohnfelder and Praerit Garg developed a model for considering attacks relevant to the Microsoft Windows development environment. (
STRIDE
Stride or STRIDE may refer to:
Computing
* STRIDE (security), spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege
* Stride (software), a successor to the cloud-based HipChat, a corporate cloud-based ...
is an
acrostic
An acrostic is a poem or other word composition in which the ''first'' letter (or syllable, or word) of each new line (or paragraph, or other recurring feature in the text) spells out a word, message or the alphabet. The term comes from the Fre ...
for: Spoofing identity, Tampering with data, Repudiation, Information disclosure, Denial of service, Elevation of privilege) The resultant mnemonic helps security professionals systematically determine how a potential attacker could utilize any threat included in STRIDE.
In 2003, OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation) method, an operations-centric threat modeling methodology, was introduced with a focus on organizational risk management.
In 2004, Frank Swiderski and
Window Snyder
Mwende Window Snyder (born 1975), better known as Window Snyder, is an American computer security expert. She has been a top security officer at Square, Inc., Apple, Fastly, Intel and Mozilla Corporation. She was also a Senior Security Strategis ...
wrote “Threat Modeling,” by Microsoft press. In it they developed the concept of using threat models to create secure applications.
In 2014 Ryan Stillions expressed the idea that
cyber threats should be expressed with different semantic levels, and proposed the DML (Detection Maturity Level) model. An attack is an instantiation of a threat scenario which is caused by a specific attacker with a specific goal in mind and a strategy for reaching that goal. The goal and strategy represent the highest semantic levels of the DML model. This is followed by the TTP (Tactics, Techniques and Procedures) which represent intermediate semantic levels. The lowest semantic levels of the DML model are the tools used by the attacker, host and observed network artifacts such as packets and payloads, and finally atomic indicators such as IP addresses at the lowest semantic level. Current
SIEM Siem is a surname. Notable people with the surname include:
* Charlie Siem (born 1986), British violinist
* Kjetil Siem (born 1960), Norwegian businessperson, journalist, author and sports official
* Kristian Siem (born 1949), Norwegian businessman ...
(Security Information and Event Management) tools typically only provide indicators at the lowest semantic levels. There is therefore a need to develop SIEM tools that can provide threat indicators at higher semantic levels.
Threat modeling methodologies for IT purposes
Conceptually, a threat modeling practice flows from a methodology. Numerous threat modeling methodologies are available for implementation. Typically, threat modeling has been implemented using one of five approaches independently, asset-centric, attacker-centric, software-centric, value and stakeholder-centric, and hybrid. Based on the volume of published online content, the methodologies discussed below are the most well known.
STRIDE methodology
The
STRIDE
Stride or STRIDE may refer to:
Computing
* STRIDE (security), spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege
* Stride (software), a successor to the cloud-based HipChat, a corporate cloud-based ...
approach to threat modeling was introduced in 1999 at Microsoft, providing a mnemonic for developers to find 'threats to our products'. STRIDE, Patterns and Practices, and Asset/entry point were amongst the threat modeling approaches developed and published by Microsoft. References to "the" Microsoft methodology commonly mean STRIDE and Data Flow Diagrams.
P.A.S.T.A.
The Process for Attack Simulation and Threat Analysis (PASTA) is a seven-step, risk-centric methodology. It provides a seven-step process for aligning business objectives and technical requirements, taking into account compliance issues and business analysis. The intent of the method is to provide a dynamic threat identification, enumeration, and scoring process. Once the threat model is completed, security subject matter experts develop a detailed analysis of the identified threats. Finally, appropriate security controls can be enumerated. This methodology is intended to provide an attacker-centric view of the application and infrastructure from which defenders can develop an asset-centric mitigation strategy.
Trike
The focus of the Trike methodology is using threat models as a risk-management tool. Within this framework, threat models are used to satisfy the security auditing process. Threat models are based on a “requirements model.” The requirements model establishes the stakeholder-defined “acceptable” level of risk assigned to each asset class. Analysis of the requirements model yields a threat model from which threats are enumerated and assigned risk values. The completed threat model is used to construct a risk model based on asset, roles, actions, and calculated risk exposure.
VAST
The Visual, Agile and Simple Threat (VAST) methodology, is based on ThreatModeler, a commercial automated threat-modeling platform. VAST requires creating two types of models: application threat models and operational threat models. Application threat models use process-flow diagrams, representing the architectural point of view. Operational threat models are created from an attacker point of view based on DFDs. This approach allows for the integration of VAST into the organization's development and DevOps lifecycles.
The Hybrid Threat Modeling Method
Researchers created this method to combine the positive elements of different methodologies. This methodology combines different methodologies, including SQUARE and the Security Cards and Personae Non Gratae.
Generally accepted IT threat modeling processes
All IT-related threat modeling processes start with creating a visual representation of the application and / or infrastructure being analyzed. The application / infrastructure is decomposed into various elements to aid in the analysis. Once completed, the visual representation is used to identify and enumerate potential threats. Further analysis of the model regarding risks associated with identified threats, prioritization of threats, and enumeration of the appropriate mitigating controls depends on the methodological basis for the threat model process being utilized. The identification and enumeration of threats (or of mitigation objectives), can either be carried out in an ''attack-centric'' way or in an ''asset-centric'' way. The former focuses on the types of possible attacks that shall be mitigated, whereas the latter focuses on the assets that shall be protected.
Visual representations based on data flow diagrams
![Data Flow Diagram - Online Banking Application](https://upload.wikimedia.org/wikipedia/commons/9/98/Data_Flow_Diagram_-_Online_Banking_Application.jpg)
The Microsoft methodology, PASTA, and Trike each develop a visual representation of the application-infrastructure utilizing
data flow diagrams (DFD). DFDs were developed in the 1970s as tool for system engineers to communicate, on a high level, how an application caused data to flow, be stored, and manipulated by the infrastructure upon which the application runs. Traditionally, DFDs utilize only four unique symbols: data flows, data stores, processes, and interactors. In the early 2000s, an additional symbol, trust boundaries, were added to allow DFDs to be utilized for threat modeling.
Once the application-infrastructure system is decomposed into its five elements, security experts consider each identified threat entry point against all known threat categories. Once the potential threats are identified, mitigating security controls can be enumerated or additional analysis can be performed.
Further fields of application
Threat modeling is being applied not only to IT but also to other areas such as vehicle,
building
A building, or edifice, is an enclosed structure with a roof and walls standing more or less permanently in one place, such as a house or factory (although there's also portable buildings). Buildings come in a variety of sizes, shapes, and fun ...
and
home automation
Home automation or domotics is building automation for a home, called a smart home or smart house. A home automation system will monitor and/or control home attributes such as lighting, climate, entertainment systems, and appliances. It m ...
.
In this context, threats to security and privacy like information about the inhabitant's movement profiles, working times, and health situations are modeled as well as physical or network-based attacks. The latter could make use of more and more available smart building features, i.e., sensors (e.g., to spy on the inhabitant) and actuators (e.g., to unlock doors).
References
{{Reflist
Computer security exploits