ThreatModeler Blogs

Articles and blog content on threat modeling and the ThreatModeler platform.

  • 107 Topics
  • 37 Replies

107 Topics

T
ThreatModeler
published in ThreatModeler Blogs

IoT Threat Modeling: An Example Highlighting the Importance of IoT SecurityBlog

Internet of Things (IoT) solutions are trending at an explosive rate, especially in the business world. With an exponential increase in devices that connect to the internet, businesses see huge benefits for communications and productivity. However, this can also leave systems and networks exposed to a growing number of new cyber threats. To help strengthen IoT application security, let’s discuss an IoT threat modeling example that can control the expansion of organizational attack surfaces.Evolving Internet of Things Security ThreatsA recent international study sponsored by the US Chamber of Commerce indicates that in just two years, as many as 85% of organizations will utilize IoT to add value to their operations.[1] By 2020, analysts predict the number of IoT devices globally to be between 20.4 and 60 billion.[2] Interconnected sensors, tags, devices, communication networks, and data are everywhere, adding value to organizations and convenience for consumers. However, without proper

250
T
3 years ago
T
ThreatModeler
published in ThreatModeler Blogs

Top 5 Password Attack Types and How to Prevent Them

Password security is no joke. It’s a security measure for the point of entry to personally identifiable information (PII), and confidential, sensitive information. The first thing anyone should know when creating an account is to never share their password. Cybercriminals are notorious for enlisting social engineering tactics to try and convince targets to reveal sensitive data such as passwords. This article will talk about five password attack types that you should know about and ways to protect against them.81% of Password-Related Hacks Involve Stolen or Weak PasswordsOne of the biggest mistakes when creating passwords is using the easy-to-guess password like admin123, 123456 or some other easy to input variation.  Warnings are all over the place, including the internet, yet people succumb to password attacks all the time. According to the 2017 Data Breach Investigations Report from Verizon, 81% of data breaches involving hackers had to do with stolen and/or weak passwords.Organizat

30
T
3 years ago
T
ThreatModeler
published in ThreatModeler Blogs

Process Flow vs. Data Flow Diagrams for Threat ModelingBlog

Threat modeling for IT system and application security entered the cybersecurity mainstream in the early 2000s. Initially, the discipline borrowed its analytic concepts from other, more mature fields. Threat trees, attacker profiles, and risk-analysis – foundational concepts in modern threat modeling – all had their theoretical beginnings in the analytic fields.When cybersecurity professionals started threat modeling, they borrowed the concept of data flow diagrams (DFD) from system engineers. The mature application and IT system deconstruction comes from process flow diagrams (PFD) which were developed specifically for cybersecurity threat modeling. The reasoning being, a web application may be visually deconstructed in the same way via process flow diagrams.DFDs are detailed flowcharts first developed in the early 1970s when applications were created to run on a specific infrastructure. At that time, considering threats to an application separately from the infrastructure would not m

420
T
3 years ago
T
ThreatModeler
published in ThreatModeler Blogs

Information Security Objectives: 8 Tips for CISOsBlog

Cybercrime continues to escalate in frequency and severity, as hackers use new and old ways to compromise information security management systems. Cybercrimes can be costly and ruinous to an organization’s reputation. According to the Ponemon Institute Cost of a Data Breach report (sponsored by IBM Security), the global average cost of a data breach has increased by 12% over the past five years.What Are the Fundamentals of Information Security?The primary information security objective is to protect information assets against threats and vulnerabilities, to which the organization’s attack surface may be exposed. Taken together, threats and vulnerabilities constitute information risk. Ensuring that security objectives are met and risk mitigated will benefit an organization by contributing to:Business continuity Operational Efficiency Cost EffectivenessAn adequate cybersecurity program should not only secure internal data that an enterprise considers confidential and/or proprietary, it s

60
T
3 years ago
T
ThreatModeler
published in ThreatModeler Blogs

Stride, VAST, Trike & More: Which Threat Modeling Methodology is Right for Your Organizations?Blog

The overwhelming number of new threats added daily to cyber ecosystems has moved threat modeling‍ from a theoretically interesting concept into a current information security standard. As threat modeling methodologies evolve, security professionals are recognizing the importance of choosing the right threat modeling methodology for an organization’s specific challenges, plus the rise of new threats that present themselves throughout a software development lifecycle.Threat Modeling Methodology FeaturesFrom a theoretical perspective, each threat modeling technique and methodology provides security teams and organizations with the means to identify threats and may be seen on equal footing. However, on a practical level, threat modeling methodologies vary in quality, consistency, and value received for the resources invested.Let’s dive a bit deeper into a few common threat modeling methodologies to better understand their strengths and weaknesses.OCTAVE (Practice Focused)The Operationally

690
T
3 years ago
T
ThreatModeler
published in ThreatModeler Blogs

Differences Explained: Threat vs. Vulnerability vs. RiskBlog

Threat, vulnerability and risk are terms that are inherent to cybersecurity. But oftentimes, organizations get their meanings confused. It is crucial for infosec managers to understand the relationships between threats and vulnerabilities so they can effectively manage the impact of a data compromise and manage IT risk.Not only should operations expenditures lower over time, organizations will build customer confidence and potentially increase sales. This article explains the key differences between vulnerability vs. threat vs. risk within the context of IT security: Threat is what an organization is defending itself against, e.g. a DoS attack. Vulnerabilities are the gaps or weaknesses that undermine an organization’s IT security efforts, e.g. a firewall flaw that lets hackers into a network.  Risk refers to the calculated assessment of potential threats to an organization’s security and vulnerabilities within its network and information systems.What is a Threat in Cybersecurity or In

180
T
3 years ago
T
ThreatModeler
published in ThreatModeler Blogs

A Day in the Life of a Threat Research EngineerBlog

With the COVID-19 pandemic impacting us worldwide and showing no signs of letting up, many cybersecurity professionals are working remotely, and taking extra measures to secure their devices and networks. We turn the spotlight on to the role of cybersecurity specialists, who are on the front lines ensuring that applications and underlying IT infrastructure stay secure for enterprises worldwide. To learn what their roles entail, we had a chat with our senior ThreatModeler research engineer, Deep Shah. You’ll discover what his day-to-day looks like and what it takes to make sure cybersecurity is not an afterthought for organizations and the multitudes of work-from-home employees. What Does a Threat Research Engineer Do? The position of a cybersecurity engineer does not just entail constructing secure IT systems, it also entails uncovering potential threats and protecting the organization’s technology environment from them.A threat research engineer:• Builds security systems• Searches for

100
T
3 years ago
Terms & ConditionsCookie settings