Threat Modeling

What is Threat Modeling?

A systematic approach to identifying, assessing, and prioritizing security risks to a system, application, or process. Helps organizations proactively identify potential threats and develop strategies to mitigate them before they occur.

A threat model typically includes:

• Description of the subject to be modeled
• Assumptions that can be checked or challenged in the future as the threat landscape changes
• Potential threats to the system
• Actions that can be taken to mitigate each threat
• A way of validating the model and threats, and verification of success of actions taken

Updating threat models is advisable after events such as:

• A new feature is released
• Security incident occurs
• Architectural or infrastructure changes

Why is Threat Modeling Important?

• Proactive Security: Helps identify and address vulnerabilities early in the development lifecycle.
• Resource Allocation: Focuses efforts on high-impact threats.
• Compliance: Assists in meeting security standards and regulations.
• Risk Management: Reduces the likelihood and impact of security breaches.

Four Question Framework

The following four question framework can help to organize threat modeling:

• What are we working on? assess scope, this might be as small as a sprint, or as large as a whole system.
• What can go wrong? can be as simple as a brainstorm, or as structured as using STRIDE, Kill Chains, or Attack Trees.
• What are we going to do about it? decide action about each threat. That might be to implement a mitigation, or to apply the accept/transfer/eliminate approaches of risk management.
• Did we do a good job? Did you do a good enough job for the system at hand?

Steps in Threat Modeling

1. Identify Objectives

• What are you protecting?
  • Define the system, data, or process you want to secure.
  • Examples: Web application, sensitive customer data, cloud infrastructure.
• What are the goals?
  • Ensure confidentiality, integrity, availability (CIA triad), or other security principles.

2. Understand the System

• Create a detailed data flow diagram (DFD) or architecture diagram showing:
  • Assets: Data, systems, and resources you need to protect.
  • Actors: Who interacts with the system? (e.g., users, administrators, third parties).
  • Entry Points: Where data or users enter the system.
  • Data Flows: How data moves within the system.
  • Trust Boundaries: Points where the level of trust changes (e.g., crossing from a user’s device to a server).

3. Identify Threats

• Use frameworks to systematically think about threats. A popular approach is STRIDE:
  • Spoofing: Impersonating another entity.
  • Tampering: Modifying data or code.
  • Repudiation: Denying actions performed (e.g., lack of logs).
  • Information Disclosure: Unauthorized access to data.
  • Denial of Service (DoS): Disrupting availability of the service.
  • Elevation of Privilege: Gaining unauthorized higher-level access.
• For example:
  • If a web application has a login page:
    • Spoofing: An attacker could impersonate a user.
    • Tampering: An attacker could modify cookies to escalate privileges.

4. Assess Risk

• For each identified threat, assess:
  • Likelihood: How likely is the threat to occur?
  • Impact: How severe would the consequences be if the threat occurs?
• Use a risk matrix or scoring system (e.g., OWASP Risk Rating Methodology).

5. Mitigate Threats

• Design and implement controls to reduce risk. Examples include:
  • Spoofing: Use strong authentication (e.g., MFA).
  • Tampering: Use encryption and integrity checks.
  • Information Disclosure: Encrypt sensitive data in transit and at rest.
  • Denial of Service: Implement rate limiting and load balancing.
• Ensure mitigations are appropriate for the risk level.

6. Validate and Iterate

• Test mitigations using techniques like:
  • Penetration testing.
  • Code reviews.
  • Threat simulations.
• Update the threat model as the system evolves (e.g., new features, integrations).

Common Threat Modeling Frameworks

1. STRIDE: Focuses on application-level threats.
2. DREAD: Rates threats based on Damage, Reproducibility, Exploitability, Affected Users, and Discoverability.
3. PASTA (Process for Attack Simulation and Threat Analysis): Risk-centric approach, focusing on business objectives.
4. LINDDUN: Focuses on privacy threats, using categories like Linkability and Non-repudiation.
5. Attack Trees: Hierarchical representation of potential attack paths.

Real-World Example: Web Application Threat Model

Objective

Secure a web application that processes customer payments.

System Understanding

• Assets: User credentials, payment data.
• Actors: Customers, admins, payment gateway.
• Entry Points: Login form, API endpoints.
• Trust Boundaries: Browser ↔ Server ↔ Payment Gateway.

Identified Threats (Using STRIDE):

1. Spoofing: Attacker uses stolen credentials.
2. Tampering: Modifies payment amounts during processing.
3. Information Disclosure: Intercepts payment details via unencrypted connections.
4. Denial of Service: Floods the server with requests.
5. Elevation of Privilege: Gains admin access by exploiting a vulnerability.

Mitigations:

• Spoofing: Enforce MFA, monitor login anomalies.
• Tampering: Use secure API keys and transaction verification.
• Information Disclosure: Enforce HTTPS and encrypt sensitive data.
• Denial of Service: Apply rate limiting, DDoS protection.
• Elevation of Privilege: Conduct regular security patching and vulnerability scans.

Final Tips

• Collaborate: Work with developers, architects, and security experts.
• Automation: Use tools like Microsoft Threat Modeling Tool or OWASP Threat Dragon.
• Continuity: Threat modeling isn’t a one-time activity; repeat it during each development cycle.

step-by-step guide to performing Threat Modeling:

1. Define Security Objectives and Scope

• What are you trying to protect?
  • Identify the key assets and goals of the system, such as sensitive data (e.g., user data, payment information, intellectual property).
  • Specify the scope of the system you’re modeling (e.g., an entire application, a single service, or an infrastructure).
• Why is it important?
  • Clarifies the security goals, such as maintaining confidentiality, integrity, and availability (CIA triad), ensuring compliance with regulations, or minimizing risk.

2. Create a System Architecture Diagram

• Understand the system components:
  • Break down the system architecture into components like:
    • External actors: Users, external services, APIs, third parties.
    • Internal components: Servers, databases, services, APIs, and their interactions.
    • Data flows: How data travels between components (e.g., client-server communication, between services).
  • Identify trust boundaries, where the system transitions between different levels of trust (e.g., from internal network to external).
• Tools:
  • Microsoft Threat Modeling Tool, OWASP Threat Dragon, draw.io for creating diagrams.

3. Identify and List Threats (STRIDE)

Use a structured approach to identify potential threats in your system. STRIDE is a common methodology:

• Spoofing: Is someone impersonating a user or service?
• Tampering: Can an attacker modify data or requests?
• Repudiation: Can an attacker deny actions, such as logging in or making a transaction?
• Information Disclosure: Is sensitive data being exposed (e.g., passwords, personal information)?
• Denial of Service: Can attackers disrupt service availability (e.g., DDoS attacks)?
• Elevation of Privilege: Can an attacker gain unauthorized access (e.g., admin privileges)?
• Example:
  • For a login page, you may identify:
    • Spoofing: Password guessing or credential stuffing.
    • Tampering: Modifying requests to change user information.
    • Information Disclosure: Exposing passwords via weak encryption.

4. Assess and Prioritize Risks

• Evaluate likelihood and impact of each identified threat:
  • Likelihood: How likely is the threat to occur? Consider the attacker’s skill, motivation, and available resources.
  • Impact: What would be the damage if the threat occurred? Consider both financial and reputational consequences.
• Risk Scoring: Assign scores to each threat based on its likelihood and impact.
  • A common approach is to use a Risk Matrix (e.g., high, medium, low).
• Example:
  • Spoofing (e.g., weak password policy) might have a high likelihood and high impact, so it should be prioritized for mitigation.
  • Denial of Service might have a low likelihood but high impact, making it a medium priority.

5. Identify Mitigation Controls

• Design controls to mitigate each threat based on its priority:
  • Spoofing: Implement strong authentication mechanisms (e.g., multi-factor authentication).
  • Tampering: Use encryption (e.g., TLS/SSL for data in transit) and integrity checks (e.g., HMAC).
  • Information Disclosure: Encrypt sensitive data at rest and in transit.
  • Denial of Service: Implement rate limiting, DDoS protection (e.g., AWS Shield).
  • Elevation of Privilege: Apply the principle of least privilege, regular security patches, and strong access controls.
• Ensure that mitigations align with the level of risk and that controls are practical and feasible to implement.

6. Validate Threat Mitigations

• Test your mitigations to ensure they work as expected:
  • Penetration Testing: Simulate attacks to see if the threats can be exploited.
  • Vulnerability Scanning: Identify any existing vulnerabilities that might be exploited.
  • Code Reviews: Check for security flaws or potential weaknesses in the codebase.
  • Security Audits: Perform audits of your architecture, controls, and processes.

7. Document and Communicate Findings

• Document the process: Keep a record of your threat model, identified threats, risk assessments, and mitigation strategies.
• Communicate the findings: Share the threat model with the development, security, and operations teams. Discuss priorities and decisions on risk management.
• Create action plans: Ensure there is a clear action plan for implementing mitigations and monitoring threats.

8. Iterate and Update

• Threat modeling is an ongoing process: Revisit your threat model regularly as the system evolves.
  • As new features are added, new threats may emerge.
  • Incorporate feedback from penetration tests and security audits.
• Monitor threats continuously: Stay aware of emerging threats, vulnerabilities, and attack vectors.

Example Scenario: Threat Modeling for an E-Commerce Application

1. Define Objectives:

• Protect customer data (e.g., credit card information, personal details).
• Ensure service availability (e.g., the website should be accessible even during traffic surges).
• Prevent fraud and unauthorized access.

2. Create System Diagram:

• Components:
  • Web server, payment gateway, database, admin panel.
  • Users (customers, admins, external payment processor).
  • Data flows: Customer submits payment -> Web server -> Payment gateway -> Database.
  • Trust boundaries: Between the web server and the payment gateway (external trust boundary).

3. Identify Threats (using STRIDE):

• Spoofing: Credential stuffing or phishing attacks to impersonate users.
• Tampering: Attacker modifying payment amounts.
• Repudiation: A customer claiming they never made a purchase.
• Information Disclosure: Sensitive user data (credit card details) being exposed.
• Denial of Service: DDoS attack on the web server.
• Elevation of Privilege: Admin account being compromised.

4. Assess Risk:

• Spoofing: High likelihood, high impact (priority 1).
• Tampering: Medium likelihood, high impact (priority 2).
• Information Disclosure: Low likelihood, high impact (priority 2).
• Denial of Service: Low likelihood, medium impact (priority 3).
• Elevation of Privilege: Medium likelihood, high impact (priority 2).

5. Mitigation Controls:

• Spoofing: Implement CAPTCHA, multi-factor authentication.
• Tampering: Use HTTPS, data integrity checks (e.g., HMAC).
• Information Disclosure: Use data encryption (AES for storage, TLS for transmission).
• Denial of Service: Rate limiting, cloud-based DDoS mitigation.
• Elevation of Privilege: Use least privilege principle, regular vulnerability scans.

6. Validate and Test:

• Run penetration tests, security audits, and use vulnerability scanning tools.

7. Document and Communicate:

• Create a threat model document, detailing identified threats, risk assessments, and mitigation actions.
• Share findings with stakeholders and development teams.

8. Iterate and Update:

• Regularly revisit the model as the application evolves.

Conclusion

Threat modeling is a structured, proactive approach to identifying, assessing, and mitigating risks in a system. By following these steps, you can strengthen the security posture of your applications and infrastructure. It’s an ongoing process that should adapt as the system evolves and new threats emerge.

1. Work from a model
2. Identify assets
3. Identify attack surfaces
4. Identify trust boundaries
5. Identify threats
6. Mitigate threats
7. Review and validate

References

Threat Modeling Threat Modeling Process Threat Modeling Manifesto OWASP Threat Modeling