# Threat Modeling ## What is Threat Modeling Threat modeling is a systematic approach to **identifying, assessing, and addressing** security threats to applications or systems. It helps in understanding potential threats, their impact, and how to mitigate them effectively. **When?** It should ideally be done in the **Planning Phase** of SDLC. ## **Process:** 1. **Assemble Threat Modeling Team:** Include diverse stakeholders from development, security, and operations. 2. **Decompose the Application:** Use Data Flow Diagrams (DFD) and UML to understand the application flow. 3. **Determine Threats:** Identify potential threats using the STRIDE model. 4. **Rank Threats:** Assess risks and prioritize threats based on their impact and likelihood. 5. **Mitigation:** Choose and implement appropriate countermeasures. **Tools**: Microsoft Threat Modeling Tool ## Key Threat Modeling Frameworks ### STRIDE **STRIDE** is a threat categorization model developed by Microsoft. It identifies potential threats by categorizing them into six different types: 1. **Spoofing: (Authentication)** Impersonating a legitimate user or system. 2. **Tampering:** **(Integrity)** Unauthorized modification of data. 3. **Repudiation: (Non-Repudiation)** Denial of performing an action without any way to prove otherwise. 4. **Information Disclosure: (Confidentiality)** Unauthorized access to confidential data. 5. **Denial of Service (DoS): (Availability)** Disrupting service availability. 6. **Elevation of Privilege: (Authorization)** Gaining unauthorized access levels. #### Steps * **Diagramming**

DFD Elements

Example from wallarm.com

Example from secodis.com

Example from Practical DevSecOps

Example from Netsec Explained Youtube

* **Threat Enumeration** * **Spoofing** * Impersonation of a legitimate user. * Using stolen credentials to access the system. * Spoofing an identity to gain unauthorized access. * **Tampering** * Modifying data in transit between systems. * Altering stored data to gain an advantage. * Tampering with configuration files or application code. * **Repudiation** * Denying actions taken within the system. * Lack of evidence for performed actions. * Disputing transaction occurrences. * **Information Disclosure** * Unauthorized access to sensitive data. * Data leaks due to insufficient encryption. * Exposure of confidential information via error messages or logs. * **Denial of Service** * Flooding the system with excessive requests to disrupt services. * Consuming all available resources, making the system unavailable. * Targeting specific vulnerabilities to cause service outages. * **Escalation of Privileges** * Gaining higher-level permissions than authorized. * Exploiting vulnerabilities to execute code with elevated privileges. * Using misconfigurations to perform unauthorized actions.

Threat Enumeration matrix

* **Mitigations** * **Spoofing** * **Multi-Factor Authentication (MFA):** Require multiple forms of verification before granting access. * **Strong Password Policies:** Enforce complex passwords and regular password changes. * **Certificate-Based Authentication:** Use certificates to validate identities. * **Biometric Authentication:** Implement biometric checks (e.g., fingerprint, facial recognition). * **IP Whitelisting:** Restrict access to trusted IP addresses. * **Tampering** * **Data Integrity Checks:** Use checksums or hash functions to verify data integrity. * **Digital Signatures:** Sign data to ensure it hasn’t been altered. * **Encryption:** Encrypt data at rest and in transit to prevent unauthorized modifications. * **Secure Software Development Lifecycle (SDLC):** Implement secure coding practices and code reviews. * **Access Controls:** Restrict permissions to modify data or configurations to authorized users only. * **Repudiation** * **Logging and Monitoring:** Implement comprehensive logging of user actions. * **Digital Signatures:** Use digital signatures to provide proof of data origin and actions. * **Non-Repudiation Services:** Implement services that provide proof of data integrity and origin. * **Audit Trails:** Maintain detailed audit trails of all critical operations. * **Time Stamps:** Include time stamps in logs to accurately track actions. * **Information Disclosure** * **Encryption:** Use strong encryption for data at rest and in transit. * **Access Controls:** Implement strict access controls based on the principle of least privilege. * **Data Masking:** Mask sensitive information in non-production environments. * **Secure Error Handling:** Ensure error messages do not reveal sensitive information. * **Regular Audits:** Perform regular security audits to identify potential data leaks. * **Denial of Service** * **Rate Limiting:** Implement rate limiting to prevent excessive requests from a single source. * **Load Balancing:** Use load balancers to distribute traffic evenly. * **Resource Allocation:** Ensure sufficient resources (CPU, memory) are allocated and can be scaled. * **DDoS Protection Services:** Use services designed to detect and mitigate DDoS attacks. * **Redundancy:** Implement redundancy in critical systems to ensure availability. * **Escalation of Privileges** * **Least Privilege:** Ensure users and processes operate with the minimum privileges necessary. * **Patch Management:** Regularly update and patch systems to fix known vulnerabilities. * **Role-Based Access Control (RBAC):** Implement RBAC to manage permissions based on roles. * **Security Testing:** Conduct regular security testing, including penetration testing and vulnerability assessments. * **Code Reviews:** Perform code reviews to identify and fix potential privilege escalation vulnerabilities. * **Validation** * Validate that the model accurately represents the system/application being modelled. * Ensure mitigations are in line with policies and risk management. ### DREAD **DREAD** is a threat ranking model used to assess the risk associated with identified threats. It evaluates threats based on five criteria: 1. **Damage Potential:** The potential impact of the threat. 2. **Reproducibility:** The ease of reproducing the threat. 3. **Exploitability:** The ease of exploiting the threat. 4. **Affected Users:** The number of users affected. 5. **Discoverability:** The likelihood of the threat being discovered. ### PASTA **PASTA** (Process for Attack Simulation and Threat Analysis) is a comprehensive threat modeling methodology with seven distinct stages. Each stage builds upon the previous one, providing a thorough understanding of the system, its threats, and risks. ## Comparing STRIDE, DREAD, and PASTA | Aspect | STRIDE | DREAD | PASTA | | -------------- | ------------------------ | ------------------- | ---------------------------------------- | | Focus | Identifying threat types | Ranking threats | Comprehensive threat modeling process | | Key Components | Six threat categories | Five risk criteria | Seven stages | | Output | Identified threats | Risk-ranked threats | End-to-end threat and risk understanding | | Ease of Use | Easy | Moderate | Complex | | Suitable for | Quick assessments | Risk prioritization | Detailed threat and risk analysis | ## Detailed Stages of Each Framework ### STRIDE **Input, Activities, Output for STRIDE** | Stage | Input | Activities | Output | | ------------------------- | ----------------------------------------- | ------------------------------------------------ | --------------------------------------------- | | Decompose the Application | System architecture, DFDs, use cases | Analyze components, data flows, and trust levels | Identified threat categories (STRIDE) | | Determine Threats | Identified assets, threat categories | Apply STRIDE to each component and data flow | List of potential threats | | Mitigation | Identified threats, security requirements | Design and implement countermeasures | Mitigation strategies and implementation plan | ### DREAD **Input, Activities, Output for DREAD** | Stage | Input | Activities | Output | | --------------------- | ----------------------------------------- | ---------------------------------------- | ------------------------------------ | | Assess Risks | Identified threats, system information | Evaluate threats using DREAD criteria | Ranked threats based on DREAD scores | | Prioritize Mitigation | Ranked threats, available resources | Determine priority of mitigation efforts | Prioritized mitigation plan | | Implement Mitigation | Mitigation plan, technical specifications | Execute mitigation strategies | Reduced risk profile | ### PASTA **Input, Activities, Output for PASTA** | Stage | Input | Activities | Output | | -------------------------- | ---------------------------------------- | ------------------------------------------------ | --------------------------------------------- | | Define the Objectives | Business requirements, security policies | Define business, security, compliance objectives | Business impact analysis, security objectives | | Define the Technical Scope | Design documents, network diagrams | Determine scope and boundaries | Technical scope and attack surface | | Decompose the Application | Use cases, architectural diagrams | Create data flow diagrams, identify assets | DFDs, asset list, trust boundaries | | Analyze the Threats | Threat intelligence, application logs | Identify and analyze threats | Threat landscape, threat agents | | Vulnerability Analysis | Vulnerability reports, threat trees | Map vulnerabilities to threats | Vulnerability overview, CVE/CWE mapping | | Attack Analysis | Technical scope, attack patterns | Develop attack trees, map attack vectors | Attack trees, attack paths | | Risk and Impact Analysis | Previous outputs, control standards | Identify risks, gaps, and mitigation strategies | Risk profile, mitigation strategy | ## **Mitigation Techniques:** * **Authentication and Authorization:** Ensure proper identity verification and access control. * **Data Validation and Sanitization:** Validate and sanitize inputs to prevent injection attacks. * **Logging and Monitoring:** Implement comprehensive logging and monitoring to detect and respond to security incidents. * **Patch Management:** Regularly update and patch software to fix vulnerabilities. ## Conclusion Each threat modeling framework has its strengths and is suitable for different scenarios. STRIDE is great for quick threat identification, DREAD helps prioritize risks, and PASTA provides a thorough, end-to-end threat and risk analysis. By understanding and applying these frameworks, security engineers can effectively manage and mitigate threats to their systems. --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://playbook.sidthoviti.com/devsecops/threat-modeling.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.