ThreatModeler Blogs

Articles and blog content on threat modeling and the ThreatModeler platform.

  • 65 Topics
  • 22 Replies

65 Topics

T
ThreatModeler
published in ThreatModeler Blogs

Do You Want Easy Threat Models or Effective Threat Models?Blog

Imagine you’re a developer in the middle of your current two-week sprint. You’re under a lot of pressure and working long days when the application architect tells you that you need to threat model your design. You may not have a lot of threat modeling experience. At that moment you probably see threat modeling as more of a hurdle to get over than a way of developing secure code. You’re probably thinking to yourself, what’s the easiest way to “check this box”? When it comes to threat modeling an application, you have a lot of options, and some of them are as simple as answering a list of questions. And if your goal is to just check the box, that’s not a bad way to go. Of course, in the back of your mind you realize that’s not going to get you the most effective threat model or, consequently, the most secure application. What to do? Threat Modeling Options The basis of any threat model is the architecture diagram. There are architecture diagrams based on data flows and there are archite

00
T
1 day ago
T
ThreatModeler
published in ThreatModeler Blogs

Why You Should do Threat Modeling to Protect Your APIsBlog

When it comes to protecting your attack surface, there’s hardly anything more challenging than APIs. After all, APIs are your way of granting public access to data you’re responsible for protecting. And if you’re going to have a public-facing door to your data, you’d better protect that door pretty well. Of course, hackers are well aware of that public-facing door. So, it should come as no surprise that API attacks are on the rise. API attacks are on the rise According to The Hacker News, “hackers are increasingly exploiting APIs to gain access to and exfiltrate sensitive data. In 2022 alone, 76% of cybersecurity professionals admitted to experiencing an API security related incident. If that wasn't attention-grabbing enough, US businesses incurred upwards of $23 billion in losses from API-related breaches during the same time period.” Just the attention they get from attackers makes APIs challenging enough to protect. But there are other reasons too. What makes protecting APIs so chal

10
T
8 days ago
T
ThreatModeler
published in ThreatModeler Blogs

Threat Modeling for Critical InfrastructureBlog

It’s not surprising that we have to protect our critical infrastructure from cyberattacks. What might be a surprise is what all constitutes critical infrastructure. There are actually 16 sectors where the United States government has set up critical infrastructure cybersecurity. “These ‘sectors’ are areas in which both public and private organizations provide vital ‘assets, services, systems, and networks’ to the citizens of the United States.” When you think of critical infrastructure, the first things that probably comes to mind are things like utilities. Some of the more obvious ones are energy services, nuclear reactors, water and wastewater systems, the chemical sector, transportation systems and communications. But critical infrastructure is more than just utilities. There are less obvious ones that also constitute critical infrastructure. These include the financial services sector, food and agriculture, healthcare, emergency services, transportation and the defense industrial b

20
T
15 days ago
T
ThreatModeler
published in ThreatModeler Blogs

Threat Modeling for ManufacturersBlog

Even with software supposedly eating the world, there are still plenty of companies that make physical things. These products may not be as sexy or profitable as software, but they are every bit as essential. From a cybersecurity standpoint, not much has changed in manufacturing, until recently. From piecemeal work to the assembly line, from manual labor to automation, manufacturing has grown increasingly more efficient over time, but without a corresponding increase in security threats, until one thing happened. Companies were already making the investments in advanced manufacturing equipment when someone got the bright idea to plug all that equipment into a network so it could all talk to each other. And while the idea of the fully networked manufacturer has been a boon for productivity and profitability, unfortunately it has also been a boon for cybercriminals who specialize in attacking networked equipment. Unique Security Challenges of Manufacturers It’s called the Internet-of-Thi

40
T
23 days ago
T
ThreatModeler
published in ThreatModeler Blogs

Threat Modeling for Healthcare OrganizationsBlog

When it comes to securing healthcare organizations, two things have become abundantly clear: Data breaches aren’t going to stop anytime soon and there’s more to protect than just data. The number of data breaches in the healthcare industry is shocking. The U.S. Department of Health and Human Services (HHS) is required to post a list of breaches of unsecured protected health information affecting 500 or more individuals. There have been 875 since December of 2020. That’s more than one per day. It’s more than just health records at risk though. Anything connected to a network, from surveillance cameras to medical devices, the so-called internet-of-things (IoT), are also at risk of attack. It’s gotten so serious, that effective March 30, 2023, “the US Food and Drug Administration (FDA) will require medical device manufacturers to provide cybersecurity information in their premarket device submissions. Additionally, beginning October 1, the FDA will exercise its authority to refuse submiss

30
T
1 month ago
T
ThreatModeler
published in ThreatModeler Blogs

Threat Modeling for Financial OrganizationsBlog

Financial organizations in general, and banks in particular, are about as far down the cybersecurity maturity curve as any industry. That should come as no surprise. Financial organizations have been dealing with threats against their assets back to when the Pinkertons were protecting stage coaches. If anyone knows about cyber threats, it’s a financial organization. Unlike other industries, that tend to have a variety of assets to protect, financial institutions have only one kind of asset to protect: money (and information related to that money). Logically, these same organizations are the earliest and widest adopters of threat modeling. The old guard institutions in the financial industry do not need to be sold on the idea of threat modeling because they are already doing it. State of the Financial Industry Financial institutions’ assets are so appealing, it remains the most targeted industry for cyber criminals. According to a cybersecurity report by Boston Consulting Group “banking

90
T
1 month ago
A
Anonymous
posted in ThreatModeler Blogs

Threat Modeling is not the same as Threat Mapping

Check out our latest blog and give us your thoughts:https://threatmodeler.com/threat-modeling-is-not-the-same-as-threat-mapping/

1
Shaiphali Mishra
1 month ago
A
Anonymous
posted in ThreatModeler Blogs

How Threat Modeling Can Help Minimize Your Application's Blast Radius

“The blast radius of a security incident is defined as the amount of damage that the incident could potentially cause. It’s every account, file, application, server or other corporate asset that could be compromised once an attacker gets ‘inside’ the system.”“An Exploit Chain is an attack that involves multiple exploits or attacks that are chained together to fully compromise a device. In these attacks, Hackers cannot use a single exploit to compromise their target but instead can combine a series of exploits that ultimately lead to malware getting installed.”Read the rest here.The blast radius and exploit chain concepts remind me of the Target hack, that was a chain starting with the HVAC system.  After they got in, nobody found them and they were able to spend time gaining a foothold.  If Target had a better model of their attack surface, they might have realized that their internal security controls were too lax.  This allowed the attackers, once inside the network, to gain access t

5
rakesh.kumar789
2 months ago
A
Anonymous
posted in ThreatModeler Blogs

Can Threat Modeling Actually Improve Incident Response?

“Immediately after an incident, especially a major one, there seems to be about 36 hours of chaos. A period of time in which there is a lot of running around, trying to figure out what to do and where to start to answer those questions above. But, if you’ve previously threat modeled the compromised system, it should short circuit a lot of the running around. It eliminates the “where do I start?” because the questions have already been answered.Without threat modeling, you are forced into a more generalized response. But having done threat modeling, you can zero in on important things faster. Since you’ve already modeled how your applications work, you know things like attack surfaces, exploitability and impact”Rest of the blog here.Those of you who’ve been unlucky enough to have to respond to an incident, does this match your experience? 

4
A
2 months ago
A
Anonymous
asked in ThreatModeler Blogs

What's Needed to Turn Developers into DevSecOps?

“According to an ESG survey, DevOps, without an embedded security process, produces some uncomfortable results. For instance, 45% of software releases didn’t go through any security checks or testing, while 35% of new builds are deployed to production with misconfigurations, vulnerabilities or other security issues.One reason (34%) for these dismal results? Security can’t keep up with the cadence of software releases. To improve these results, something must change, and one impactful change is incorporating continuous threat modeling into the DevOps flow.”Read the rest here.What’s been your experience with DevSecOps and integrating security into development? One good experience I had was working at Automox with a CISO who described himself as “the most business friendly CISO you’re ever going to meet”.  He’s now head of security at Zoom so that strategy has been wonderful for his career.  And it was a pleasure to work with him on company security concerns.Any success or horror stories

6
A
3 months ago
A
Anonymous
posted in ThreatModeler Blogs

How to Maximize the Impact of your Threat Modeling: An Overview of the ThreatModeler Community Resources

“If you’re a first-time threat modeler, threat modeling can seem overwhelming. Maybe you’re following one of the common threat modeling frameworks like STRIDE or OWASP. Or maybe you’ve already invested in an automated threat modeling tool like ThreatModeler. Either way, it may not be enough.If you hope to maximize the impact of your threat modeling, what you really need is some support, guidance and access to other threat modeling resources. In this article, we share how you can have all of these through the ThreatModeler Community.” - check out the rest of the blog for an overview of the different areas of the community.

1
Sudhakanta Mohanty
3 months ago
A
Anonymous
posted in ThreatModeler Blogs

Seven Common Misconceptions about Threat Modeling

“Misconception 1: Threat Modeling Requires Threat Modeling ExpertiseIt certainly doesn’t hurt to have years of threat modeling experience creating process flow diagrams or data flow diagrams, but it’s no longer necessary.It’s not feasible to expect developers to also be security mitigation experts. So, for a while, outside expertise was required to do in-house threat modeling. Today, most of the threat modeling expertise is built right into threat modeling tools making threat modeling is just one more part of a developer’s IDE.”Check out 2 through 7 on our blog here.  Number 5 will shock you! (I couldn’t resist the clickbait CTA 😀)Do any of these misconceptions resonate with you?  Have they held you back from starting a threat modeling project?

2
A
3 months ago
A
Anonymous
posted in ThreatModeler Blogs

An Overlooked Reason Why There Are So Many Data Breaches

“Take a look at the headlines in any security news outlet and one thing really stands out. There are data breaches everywhere. That happen all the time, to organizations that know better. And it’s not like anyone wants a data breach. In fact, just the opposite is true. Companies try really hard to prevent them, often to no avail.So, why are so many data breaches happening? The truth is there are a lot of reasons. According to Help Net Security, two of the biggest reasons are social engineering and unsecured databases. In addition to these though, there is another, often overlooked reason.”Check out the rest of the blog here.What has been your experience?  Have you worked somewhere that treated cybersecurity properly as a continuous process, or was it mostly just getting your SOC 2 Type II and then letting the effort lapse until the next annual audit?

1
Kristen Canady
4 months ago
T
ThreatModeler
published in ThreatModeler Blogs

Are Your Threat Models Ready for Q-Day?Blog

Threat models are really good at identifying and mitigating cybersecurity threats. But they’re not much good at addressing threats nobody knows about. And that brings us to the security threats expected to arrive on Q-Day. We know about some of the threats that are coming, but not all of them, and we may be running out of time. Q-Day is Coming What is Q-Day? From Help Net Security, Q-Day, or Quantum Day, “represents the day that quantum computers will reliably use the super positioning power of multi-state qubits to break encryption algorithms that are widely used around the world to enable e-commerce, data security and secure communications.” Q-Day will force every application developer to reimagine encryption and security. The good news? Q-Day is not here yet. The bad news? It may be only five to ten years away, some think sooner. And since it represents a seismic shift in the treat landscape, the time to start preparing for Q-Day is today. Quantum computers will have an almost unfat

60
T
4 months ago
T
ThreatModeler
published in ThreatModeler Blogs

The Value of a Community Marketplace in Democratizing DevSecOpsBlog

When companies do business, invariably they try to differentiate themselves in some way. Maybe it’s the uniqueness of their offering, the quality of their service or perhaps even their intellectual property. Any of these can afford a company a competitive advantage in the market. Rarely however do organizations try to differentiate themselves by the robustness of the cybersecurity posture or their approach to DevSecOps. When it comes to security, most companies want to be sufficiently secure so that it does not detract from their competitive advantage. From a business standpoint, they just want to break even on security. Every Organization Faces the Same Challenges When it comes to securing applications, every organization faces the same challenges. They share the same tools, time limits, threat landscape and regulations. And the threat landscape and regulations are constantly evolving. Since knowing a company’s approach to security is rarely a threat to its intellectual property or tr

10
T
4 months ago
T
ThreatModeler
published in ThreatModeler Blogs

Are Risk Assessment and Threat Modeling Really Two Different Things?Blog

We hear a lot about risk assessment and threat modeling. Are they just two terms for the same thing, or are they different? In this brief article, we discuss the subtle differences between the two and show how the line between them is blurring. What is the True Purpose of Risk Assessment? Risk assessment encompasses several activities. According to the American Society of Safety Professionals, conducting a risk assessment consists of three major activities: risk identification, risk analysis and risk evaluation. Risk identification is concerned with understanding the consequences and impacts of individual risks. Risk analysis is about prioritizing the risks based on those consequences and impacts. And risk evaluation is about answering these questions for each risk: Can we handle it? Do we need controls? If so, what might they be? NIST takes it a step further by adding in their definition of risk assessment that “Part of risk management, incorporates threat and vulnerability analyses,

30
T
4 months ago
T
ThreatModeler
published in ThreatModeler Blogs

Another Year—Another Reason to do Threat ModelingBlog

It’s 2023 and the world of application development is slowly but surely migrating from DevOps to DevSecOps. As you probably know, DevSecOps “automates the integration of security at every phase of the software development lifecycle, from initial design through integration, testing, deployment, and software delivery.” If you haven’t already migrated from DevOps to DevSecOps, we can give you one more reason that now’s the time to do it. The DoD Thinks it’s a Good Idea The U.S. Department of Defense (DoD) thinks DevSecOps is a good idea. So much so that they published the DevSecOps Fundamentals Guidebook: DevSecOps Tools & Activities. According to the guidebook’s introduction, “The goal of DevSecOps is to improve customer outcomes and mission value through the automation, monitoring, and application of security at every phase of the software lifecycle. Practicing DevSecOps requires an array of purpose-built tools and a wide range of activities that rely on those tools. This document c

10
T
5 months ago
T
ThreatModeler
published in ThreatModeler Blogs

ThreatModeler: Year in ReviewBlog

As 2022 comes to an end, we’ve definitely seen some major themes emerge with regard to threat modeling. In this year in review, we discuss some of the more important ones. The Ever Expanding Scope of Threat Modeling Perhaps the most recurrent theme in 2022 was the ever expanding scope of threat modeling. It’s not just for application development anymore. For starters, we’ve seen how Threat Modeling Answers More Business Questions Than Security Questions. Some of the more important questions being, am I spending too much on security? and what is secure enough? In Threat Modeling: It’s not Just for IT Anymore, we discuss the important role threat modeling is starting to play in operational technology (OT), the hardware and software that controls and operates the physical mechanisms of an organization. Another theme that kept coming up is how threat modeling can be used to identify and mitigate non-security threats. In Gain Insights Into Your Attack Surface and Compliance Requirements Wit

60
T
5 months ago
T
ThreatModeler
published in ThreatModeler Blogs

Three Reasons to Invest in a Threat Modeling ToolBlog

We’ve reached the point where security decision makers have come to embrace the idea of threat modeling. The notion of finding and eliminating cyber vulnerabilities before they become cyber incidents is a pretty easy idea to get behind. But just because decision makers have gotten on board with threat modeling, doesn’t mean they’ve made the investment in threat modeling tools. After all, to generate the main artifacts of threat modeling (i.e., data flow diagrams and process flow diagrams) does not require a tool. A practitioner with sufficient expertise and a whiteboard could produce these deliverables. So, what is the justification for investing in a threat modeling tool? There are at least three. Automation There are plenty of threat modeling aids available. These include frameworks likes STRIDE, OWASP Top 10 and MITRE ATT&CK. There are also “tools”, like those from Microsoft, which aren’t much more than a digital whiteboard. All of these still require a practitioner to build the

40
T
5 months ago
T
ThreatModeler
published in ThreatModeler Blogs

Threat Modeling and Your Software Bill of MaterialBlog

When you experience enough high-profile security breaches, like have happened recently (e.g., Log4j), eventually somebody is going to do something about it. And that someone is President Biden, who issued Executive Order 14028. Among other things, EO 14028 included a recommendation for a requirement for a software Bill of Materials (SBOM) to ensure the safety and integrity of software applications used by the federal government. What is an SBOM? According to the National Telecommunications and Information Administration (NTIA), the driving force behind the SBOM, “An SBOM is a formal, machine-readable inventory of software components and dependencies, information about those components, and their hierarchical relationships. SBOMs may include open source or proprietary software and can be widely available or access-restricted.” The SBOM actually supports three categories of stakeholders: those who build software, those who purchase software and those who operate software. That pretty muc

91
L
6 months ago
T
ThreatModeler
published in ThreatModeler Blogs

Is This the Missing Piece to Widespread Threat Modeling Adoption?Blog

Threat modeling is an effective process for identifying and prioritizing threats and recommending mitigations for software-based systems. In a world with so many cyber threats, that’s not a bad thing. So, why hasn’t threat modeling been more widely adopted? And is a missing piece the answer to greater adoption?A Brief History Of Threat ModelingThe practice of threat modeling actually dates back to the mid-90s. And unlike almost every other cybersecurity practice, threat modeling has resisted being turned into an easy process.Unlike things we take for granted like static analysis and penetration testing, threat modeling still requires, to some degree, input from security experts. Even though there are threat modeling tools that automate much of the threat modeling process, it still requires practitioners with security experience to address the one question that can’t really be answered.The One Question That Can’t Be AnsweredHow do I  know if my software is secure enough? That’s the one

10
T
6 months ago
T
ThreatModeler
published in ThreatModeler Blogs

Happy Thanksgiving From ThanksModeler

One week a year, ThreatModeler becomes ThanksModeler. A week where we give thanks for all we have, all we get to do, and more importantly, who we get to serve. Thanks for all we Have At the top of the list of things we’re thankful for is everyone who is a part of the ThreatModeler family. That includes employees, suppliers, advisors and associates. And starting in late 2022, it includes one more group: the ThreatModeler Community. The ThreatModeler Community is built for those who hope to use ThreatModeler to minimize risk with threat modeling. It includes discussions, guides, groups, product updates and ThreatModeler help. If you haven’t done so already, we invite you to be part of the ThreatModeler family by joining the ThreatModeler Community. Thanks for all we Get to do It would be nice if we lived in a world where we didn’t need cybersecurity, but we do. And if there has to be cybersecurity, we may as well partake in it. Cybersecurity is an exciting and challenging industry and we

20
T
6 months ago
T
ThreatModeler
published in ThreatModeler Blogs

AWS RE:INVENT 2022  – WHAT’S IN, WHAT’S HOT AND WHAT’S MISSING IN SECURITY

It’s that time again. AWS re:Invent returns to Las Vegas at the end of November. As many as 60,000 are expected to attend. So, what do you need to know if you’re going?In this article, we cover what’s in, what’s hot and what we think may be missing from AWS re:Invent 2022 in the area of security. What’s InYou can tell what’s in at AWS re:Invent 2022 in the security arena by searching through the session catalog. Subjects of importance tend to get greater time and attention. And one of the first ones that pops up is AWS Well-Architected.AWS Well-Architected “helps cloud architects build secure, high-performing, resilient, and efficient infrastructure for a variety of applications and workloads.” It’s built around six pillars, one of which is security. Naturally AWS wants their customers’ cloud deployments to be successful and AWS Well-Architected is one way to make that happen. It make perfect sense that it’s “in” at the conference.Another theme which seems to permeate this year’s sessi

21
Kristen Canady
6 months ago
T
ThreatModeler
published in ThreatModeler Blogs

The Most Important Part of Cybersecurity Requires no Cybersecurity ProductsBlog

It’s tempting to look for your cybersecurity solutions at a cybersecurity tradeshow. After all, that’s where all the latest and greatest cybersecurity products are on display. You just walk around, listen to the marketing pitches and choose the best products. There are two reasons why that may not be the best course of action. Let’s call them product conundrums #1 & #2. Product Conundrum #1 The first conundrum, when selecting a cybersecurity product, is that some vendors are better at product marketing than they are at product development. This is best detailed in a recent Security Week article entitled Are Cybersecurity Vendors Pushing Snake Oil? The content of the article is based on research done by Egress. What did the research find? Among other things, that “91% of decision makers have difficulty in selecting cybersecurity vendors due to unclear marketing about their specific offerings.” This unclear marketing is a direct result of an increasingly crowded marketplace. The crow

60
T
6 months ago
T
ThreatModeler
published in ThreatModeler Blogs

A Case for Automated Threat Modeling

Nobody thinks modeling threats is a bad idea. And yet threat modeling isn’t broadly adopted in the development community yet. Why is that? According to Izar Tarandach and Matthew J. Coles in their book Threat Modeling, it’s because “convincing stakeholders that threat modeling is important can be difficult.”As the two writers go on to explain, there are a lot of reasons for that including everyone being busy, not everyone understanding the system, and not all architects and coders having a complete understanding of what they’re working on.But probably the most important reason is that threat modeling is hard. It takes highly specialized talent and there is a lot to know, which requires both a breadth and depth of knowledge and experience. So, the default position for many organizations—organizations that could really benefit from threat modeling—is to do nothing.Automated Threat ModelingIf threat modeling had continued to be a manual activity, it would for all intents and purposes, be

60
T
9 months ago
Terms & ConditionsCookie settings