HACKER Q&A
📣 appsec-monk

How do you perform threat modeling in your project


Threat modeling seems to be a hot topic that every security team wants to talk about. How do you folks do threat modeling in your project/product/app? Which tools are being used or methodologies for example STRIDE I am also curious if open source project leaders care about threat modeling ?


  👤 arkenoi Accepted Answer ✓
almost two weeks and no comments?!

amazing.

Ok, so let's dive in.

First, "threat modelling" is a very broad, I'd even say "umbrella" term. It ranges, basically, from creating a simple google sheet document "what could go wrong" to a complicated graph-based quantitative modelling.

And I would say, you get more value from the simple spreadsheet. The rest is complicated voodoo which takes a lot of resources and still gives you quite ambiguous results. But it is fun to do as well.

STRIDE is nice, and it is kind of de facto standard, but when it comes to classifying actual threats you would notice that everything is interconnected. You cannnot separate one letter in STRIDE from another in most threat scenarios you encounter! Spoofing leads you to tampering, elevation of privilege to information disclosure and finally you try to arrange the whole mess in a minimally comprehencible way. So I would say, what you are actually interested in is not classifying everything in STRIDE or making complicated attack graphs, but trying to identify threat "building blocks" like a software bug or a workstation compromise and build a few typical "worst-case" scenarios around that.

See also "Crown Jewel Analysis" and "ATT&ACK", both would help you much. Feel free to contact me if you need more assisitance :)