Threat modelling is a methodology used in the design phase of an application to identify, based on the
architecture of the application, the possible threats capable of acting on the various points of the
architecture nodes or connectors.
Once threats have been identified, it is therefore possible to draw up specific security requirements
and specifications to be implemented to mitigate the identified threats.
Threat modelling consists of four phases.
The first step is to create a visual graphic representation of the application.
Then in the second phase, the architecture is broken down into constituent parts.
And in the third phase, the various threats looming over the decomposed architecture are identified
and enumerated.
In the fourth and final phase, a risk analysis is carried out for the various threats identified in
order to give priority to mitigating them, choosing the most appropriate security controls to be applied.
For the identification of threats, it is possible to rely, for example, on the Microsoft STRIDE methodology
an acronym that takes its name from the five possible categories of threats such as spoofing, tampering,
repudiation, information disclosure, denial of service and elevation of privilege.
There are also other methods that can be used for threat modeling, the slide shows some of them.
As for the visual representation of the application architecture, one of the most used diagrams in
threat modeling is the dataflow diagram.
It highlights the architecture of the application in terms of processes, entities, data stores and
data flows, and the pre-eminent emphasis is given on the data flows that connect processes, entities
and data stores together.
As an alternative to the Data Flow diagram, you can start making threat modeling from a Process Flow
diagram, structured as the example of the slide. In this type of diagram, the main emphasis is placed
on the functional representation of the processes that make up the application.
Starting from the visual representation of the application, we move on to identify the threats
that exist on the individual nodes by means of input data and the entire path that can be involved by
the threats.
The threat path is defined as the sequence of all processes nodes that perform critical security processing.
In this slide you can find some example of questions, you can ask yourself to identify possible threats
looming on the dataflow diagram architecture.
Then the identified threats, can be classified and categorized according to, for example, the
already mentioned stride methodology.
For each type of asset or target of the data flow diagram structure, it is possible to know in advance
which categories of threats could theoretically act in the absence of controls as shown in the table.
Starting from the identified threats, you can then move on to expand the tree of possible sub threats.
Here is an example of creating a tree of possible sub-threats from a primary spoofing threat.
The last phase, after identifying all the possible primary and secondary threats on the dataflow diagram,
consists in attributing a risk factor to each of them and determining the possible security controls
to be implemented to mitigate them.
In broad terms, the table shows the general types of mitigation corresponding to each threat category
of the stride model, for example, to mitigate the categories of threats included in the type of tampering
methods must be adopted to guarantee and verify the integrity of the data.
Therefore, for example, through the use of hashing algorithms.
A simple tool that can be used to assist the entire threat modeling process is, for example, the Microsoft
threat modeling tool.
But there are also other tools that can be used to avoid a completely manual approach to threat modeling.
Thank you for your kind attention.