Threat Modelling

STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege)

PASTA (Process for Attack Simulation and Threat Analysis)

VAST (Visual, Agile, and Simple Threat)

OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation) 

NIST Threat Modelling Guide (800-154, draft edition)

A process of predicting all possible potential threats.

A structured representation of all assets/information through the lens of security.

An act of foreseeing threats, identified, categorized, analysed and fixed early stages.

Helps to reduce attack surface, system secure and trustworthy.

Increase security posture of an organization in a cost-effective manner.

Used for conducting risk assessment, VAPT and auditing and compliance purposes.

Asset identification: In this step, we will identify and list the critical assets within the organization network. These assets could be anything of value, such as data, hardware, software, services, or even personnel. By identifying these assets, we gain a clear understanding of what needs protection and what could potentially be targeted by threats.

DFD Diagram: A Data Flow Diagram is a visual representation of how data flows through the system. It consists of processes, data stores, data flow, and external entities. Creating a DFD helps us map out the interactions between different components of our system, including how data moves between them. This diagram serves as a foundation for identifying potential vulnerabilities and threats.

Threat Identification: In this step, we systematically identify potential threats and vulnerabilities that could exploit the weaknesses in the system. This involves brainstorming, researching common attack vectors, and analyzing potential scenarios where malicious actors might compromise the assets or data.

Mitigation: Once we’ve identified potential threats, we develop strategies to mitigate or reduce their impact. Mitigation measures can include implementing security controls, using encryption, enforcing access controls, applying patches and updates, and following best practices to minimize vulnerabilities. The goal is to strengthen our system’s defenses against identified threats.

Validation: Validation involves testing the effectiveness of our mitigation strategies. This can include both theoretical analysis and practical testing. Validation helps ensure that our system is more resilient against potential threats.