Adam Englander, profile picture
Uploaded byAdam Englander
PDF, PPTX309 views

Threat Modeling for Dummies

The document discusses threat modeling and provides an overview of the threat modeling process. It describes documenting assets and entry points, identifying threats using techniques like STRIDE and attack trees, assessing risk with DREAD, and resolving threats by mitigating them in stages from quick reductions to complete mitigation. An example threat of an insider attack on a database is analyzed in detail. The document concludes by recommending starting with the OWASP Top 10, incorporating threat modeling into the SDLC, and improving skills through resources like books and games.

Technology◦
Related topics:
Information Security•

Embed presentation

Download as PDF, PPTX
@adam_englander Building Secure Applications: Threat Modeling for Dummies Adam Englander Manager of Engineering, TransUnion
@adam_englander What Are We Going to Cover • An overview of threat modeling • The process of threat modeling • Some common tools to assist you • An example from start to finish • Action items for now, near future, and beyond
@adam_englander What is threat modeling?
@adam_englander –Wikipedia “Threat modeling is a process by which potential threats … can be identified, enumerated, and prioritized – all from a hypothetical attacker’s point of view.”
@adam_englander –Wikipedia “Threat modeling is a process by which potential threats … can be identified, enumerated, and prioritized – all from a hypothetical attacker’s point of view.”
@adam_englander What’s the process?
@adam_englander Document All the Things!
@adam_englander Map Out Your Application
@adam_englander Internet Internal DMZ System: Big Picture Firewall Load Balancer MySQL MySQL App Server Firewall DNS SMTPCDN Alerting Stats Bastion Logs Consumer Payment CA
@adam_englander Process: Microscope User Logs In Views Product Catalog Adds Item to Cart Initiates Checkout Confirms Billing Info Selects Payment Method Confirms Shipping Info/ Method Confirmation Email Sent Payment Authorized
@adam_englander Identify Assets Commerce Site DB Credentials SMTP Credentials Payment GW Creds Encryption Keys SSL Certs SSL Private Keys Access to SMTP Database Cust Emails Cust Billing Data Cust PII Payment Data Order History User Credentials User Emails Shopping Carts Sessions Inventory/Pricing Transaction Logs SMTP DKIM Creds Mail Logs Payment Gateway Purchase History Charge/Refund Authority Log Server Raw Logs Host Names Stack Traces Client IPs User Behavior Internal Network DB Admin Creds Hosting Creds DNS Admin Creds Payment GW Admin Creds Encryption Keys SSL Certs SSL Private Keys
@adam_englander Identify Entry Points Firewall App Server Database HTTPS Unrestricted Internal Network Internet Firewall
@adam_englander Identify Entry Points Firewall App Server Database HTTPS Unrestricted Internal Network Internet Firewall
@adam_englander Identify Entry Points Firewall App Server Database HTTPS Unrestricted Internal Network Internet Firewall
@adam_englander Identify Entry Points Firewall App Server Database HTTPS Unrestricted Internal Network Internet Firewall
@adam_englander Identify Dependencies
@adam_englander Out-of-Band Dependencies CI/CD Server Library RepositoryCode Repository Configuration Management Build Tools 3rd Party Code 3rd Party Libraries
@adam_englander Internet Internal DMZ Critical Dependencies Firewall Load Balancer MySQL MySQL App Server Firewall DNS SMTPCDN Alerting Stats Bastion Logs Consumer Payment CA
@adam_englander Internet Internal DMZ Secondary Dependencies Firewall Load Balancer MySQL MySQL App Server Firewall DNS SMTPCDN Alerting Stats Bastion Logs Consumer Payment CA
@adam_englander Identify Anything Else Significant
@adam_englander Identify Threats
@adam_englander What about fully mitigated threats?
@adam_englander Identifying Threats with STRIDE • Spoofing - The attacker presents themselves as another user • Tampering - Altering code, data, processes • Repudiation - Providing ability to deny who performed an action • Information disclosure - Attacker discloses secret information • Denial of Service - Your system is partially or fully unavailable • Elevation of Privilege - Accessing items for higher level user
@adam_englander Mapping Attacks with Attack Trees Enter House Through Window Through Door Break Window Force Open Stolen Credentials Authorized User
@adam_englander Quantifying Risk with DREAD • Damage – how bad would an attack be? • Reproducibility – how easy is it to reproduce the attack? • Exploitability – how much work is it to launch the attack? • Affected users – how many people will be impacted? • Discoverability – how easy is it to discover the threat?
@adam_englander Resolve the Threat
@adam_englander Mitigate Large Threats in Stages Terrible Bad Okay Complete
@adam_englander There Is No Absolute Terrible Bad Okay Complete
@adam_englander Quick Reduction of Threat Terrible Bad Okay Complete
@adam_englander Acceptable Reduction Terrible Bad Okay Complete
@adam_englander Complete Mitigation Terrible Bad Okay Complete
@adam_englander Example: Insider Attack
@adam_englander Actor Lone Gunman Competitor Organized Crime Nation State Hactivist Internal Attacker
@adam_englander Asset Commerce Site DB Credentials SMTP Credentials Payment GW Creds Encryption Keys SSL Certs SSL Private Keys Access to SMTP Database Cust Emails Cust Billing Data Cust PII Payment Data Order History User Credentials User Emails Shopping Carts Sessions Inventory/Pricing Transaction Logs SMTP DKIM Creds Mail Logs Payment Gateway Purchase History Charge/Refund Authority Log Server Raw Logs Host Names Stack Traces Client IPs User Behavior Internal Network DB Admin Creds Hosting Creds DNS Admin Creds Payment GW Admin Creds Encryption Keys SSL Certs SSL Private Keys
@adam_englander Entry Point Firewall App Server Database HTTPS UnrestrictedMySQL/TLS Internal Network Internet Firewall
@adam_englander Attack Tree Access Database From Web Server Internal Network Remote Execution SQL Injection Stolen Credentials Authorized User
@adam_englander Attack Tree Stolen Credentials From App Server Code Repository From CI Server
@adam_englander Inside attackers can access all customer PII and PC data from databases using credentials from code repositories on any computer on the internal network and not be discovered via logging
@adam_englander DREAD • Damage: Liability for stolen credit card transactions, loss of credibility, loss of revenue • Reproducibility: The skills necessary would be knowing how to copy down the git repo and execute queries via mysql • Exploitability: There are no considerations beyond install git and mysql-client to perform the attack
@adam_englander DREAD • Affected Users: All user PII and billing data would be accessible • Discoverability: Any user with minimal knowledge of the framework would know how to find configs containing DB credentials and connection information.
@adam_englander Quick Reduction • Database access and query logging for non- repudiation • Restrict read access to the git repo
@adam_englander Mitigation Phase 1 • Have credentials setup on servers by admins • Remove database credentials from git repo • Change credentials to prevent leaked credentials from being utilized going forward
@adam_englander Phase 2 • Restrict access for users to appropriate data • Restrict access to appropriate IP addresses
@adam_englander Phase 3 • Encrypt PII and PC data in the database • Develop and implement key rotation strategy for application secrets
@adam_englander Completely Mitigate • Anonymize link between PC data and PII • Create honey pots for credentials still in git repos that will allow users to see what appears to be real data. These logins will be recorded and alerts will be sent to security personnel to apprehend the culprit
@adam_englander How do I get started?
@adam_englander Right Now: Knock out the OWASP Top 10!
@adam_englander OWASP Top 10 https://www.owasp.org/index.php/Category:OWASP_Top_Ten_2017_Project
@adam_englander Near Term: Incorporate threat modeling into your Software Development Lifecycle
@adam_englander Threat Modeling in SDLC Design Threat Model Build Threat Model Release Test
@adam_englander Long Term: Map out and model your applications.
@adam_englander Long Term: Improve your skills!
@adam_englander Elevation of Privilege Card Game https://www.microsoft.com/en-us/SDL/ adopt/eop.aspx https://www.microsoft.com/en-us/SDL/adopt/eop.aspx
@adam_englander Threat Modeling: Designing for Security By Adam Shostack ISBN-13: 978-1118809990
@adam_englander Red/Blue Team Field Manual
@adam_englander Questions and Comments

More Related Content

PDF
Threat Modeling Using STRIDE
byGirindro Pringgo Digdo
 
PDF
Hunting for Privilege Escalation in Windows Environment
byTeymur Kheirkhabarov
 
PDF
Hunting Lateral Movement in Windows Infrastructure
bySergey Soldatov
 
PDF
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...
byMITRE ATT&CK
 
PPTX
Threat Modeling And Analysis
byLalit Kale
 
PPTX
Putting MITRE ATT&CK into Action with What You Have, Where You Are
byKatie Nickels
 
PDF
ATT&CKing the Red/Blue Divide
byMITRE ATT&CK
 
PDF
The ATT&CK Philharmonic
byMITRE ATT&CK
 
Threat Modeling Using STRIDE
byGirindro Pringgo Digdo
 
Hunting for Privilege Escalation in Windows Environment
byTeymur Kheirkhabarov
 
Hunting Lateral Movement in Windows Infrastructure
bySergey Soldatov
 
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...
byMITRE ATT&CK
 
Threat Modeling And Analysis
byLalit Kale
 
Putting MITRE ATT&CK into Action with What You Have, Where You Are
byKatie Nickels
 
ATT&CKing the Red/Blue Divide
byMITRE ATT&CK
 
The ATT&CK Philharmonic
byMITRE ATT&CK
 

What's hot

PPTX
C2 Matrix A Comparison of Command and Control Frameworks
byJorge Orchilles
 
PPTX
Introduction to Malware Analysis
byAndrew McNicol
 
PPTX
Cyber Threat Hunting Workshop
byDigit Oktavianto
 
PDF
ATT&CKcon Intro
byMITRE ATT&CK
 
PPTX
Malware classification using Machine Learning
byJapneet Singh
 
PDF
Hunting for Credentials Dumping in Windows Environment
byTeymur Kheirkhabarov
 
PDF
Developing a Threat Modeling Mindset
byRobert Hurlbut
 
PPTX
Effective Threat Hunting with Tactical Threat Intelligence
byDhruv Majumdar
 
PDF
Threat Modeling Basics with Examples
bySanjeev Kumar Jaiswal
 
PPT
STRIDE And DREAD
bychuckbt
 
PDF
Threat Hunting
bySplunk
 
PDF
Understanding Fileless (or Non-Malware) Attacks and How to Stop Them
byCrowdStrike
 
PDF
Exploring how Students Map Social Engineering Techniques to the ATT&CK Framew...
byMITRE ATT&CK
 
PDF
Windows Threat Hunting
byGIBIN JOHN
 
PDF
ATT&CK Updates- Defensive ATT&CK
byMITRE ATT&CK
 
PPTX
VAPT PRESENTATION full.pptx
byDARSHANBHAVSAR14
 
PDF
2019 DevSecOps Reference Architectures
bySonatype
 
PDF
ATT&CK Updates- ATT&CK's Open Source
byMITRE ATT&CK
 
PDF
Threat Hunting with Cyber Kill Chain
bySuwitcha Musijaral CISSP,CISA,GWAPT,SNORTCP
 
PDF
Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...
byJorge Orchilles
 
C2 Matrix A Comparison of Command and Control Frameworks
byJorge Orchilles
 
Introduction to Malware Analysis
byAndrew McNicol
 
Cyber Threat Hunting Workshop
byDigit Oktavianto
 
ATT&CKcon Intro
byMITRE ATT&CK
 
Malware classification using Machine Learning
byJapneet Singh
 
Hunting for Credentials Dumping in Windows Environment
byTeymur Kheirkhabarov
 
Developing a Threat Modeling Mindset
byRobert Hurlbut
 
Effective Threat Hunting with Tactical Threat Intelligence
byDhruv Majumdar
 
Threat Modeling Basics with Examples
bySanjeev Kumar Jaiswal
 
STRIDE And DREAD
bychuckbt
 
Threat Hunting
bySplunk
 
Understanding Fileless (or Non-Malware) Attacks and How to Stop Them
byCrowdStrike
 
Exploring how Students Map Social Engineering Techniques to the ATT&CK Framew...
byMITRE ATT&CK
 
Windows Threat Hunting
byGIBIN JOHN
 
ATT&CK Updates- Defensive ATT&CK
byMITRE ATT&CK
 
VAPT PRESENTATION full.pptx
byDARSHANBHAVSAR14
 
2019 DevSecOps Reference Architectures
bySonatype
 
ATT&CK Updates- ATT&CK's Open Source
byMITRE ATT&CK
 
Threat Hunting with Cyber Kill Chain
bySuwitcha Musijaral CISSP,CISA,GWAPT,SNORTCP
 
Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...
byJorge Orchilles
 

Similar to Threat Modeling for Dummies

PDF
Threat Modeling for Dummies - Cascadia PHP 2018
byAdam Englander
 
PPTX
7 Steps to Threat Modeling
byDanny Wong
 
PDF
Application Threat Modeling
byPriyanka Aash
 
PPTX
OWASP_Training.pptx
byPradip Bhattarai
 
PDF
Threat_Modelling.pdf
byMarlboroAbyad
 
PDF
Threat Modeling to Reduce Software Security Risk
bySecurity Innovation
 
PPTX
Improving web application security, part i
byKangkan Goswami
 
PPTX
Improving web application security, part i
byKangkan Goswami
 
PPTX
Threat Modeling - Locking the Door to Vulnerabilities
bySecurity Innovation
 
PPT
Security Compliance Web Application Risk Management
byMarco Morana
 
PPTX
Architecting for Security Resilience
byJoel Aleburu
 
PPTX
Personal Threat Models
byGeoffrey Vaughan
 
PPTX
TACOM 2014: Back To Basics
byJoel Cardella
 
PDF
Null bachav
byNaga Venkata Sunil Alamuri
 
PDF
Session2-Application Threat Modeling
byzakieh alizadeh
 
PDF
Unit 1 Notes Revision.pdftttttttttttttttttttt
bysriram37357
 
PPTX
bhumi verma dentition in mammals -aman.pptxhhdbshdbsbdhsdbhdbhs
bysarasdivyansh1608
 
PDF
Application Threat Modeling In Risk Management
byMel Drews
 
PPTX
Secure Iowa Oct 2016
byLarry Slobodzian
 
PPTX
Web Security Overview
byNoah Jaehnert
 
Threat Modeling for Dummies - Cascadia PHP 2018
byAdam Englander
 
7 Steps to Threat Modeling
byDanny Wong
 
Application Threat Modeling
byPriyanka Aash
 
OWASP_Training.pptx
byPradip Bhattarai
 
Threat_Modelling.pdf
byMarlboroAbyad
 
Threat Modeling to Reduce Software Security Risk
bySecurity Innovation
 
Improving web application security, part i
byKangkan Goswami
 
Improving web application security, part i
byKangkan Goswami
 
Threat Modeling - Locking the Door to Vulnerabilities
bySecurity Innovation
 
Security Compliance Web Application Risk Management
byMarco Morana
 
Architecting for Security Resilience
byJoel Aleburu
 
Personal Threat Models
byGeoffrey Vaughan
 
TACOM 2014: Back To Basics
byJoel Cardella
 
Null bachav
byNaga Venkata Sunil Alamuri
 
Session2-Application Threat Modeling
byzakieh alizadeh
 
Unit 1 Notes Revision.pdftttttttttttttttttttt
bysriram37357
 
bhumi verma dentition in mammals -aman.pptxhhdbshdbsbdhsdbhdbhs
bysarasdivyansh1608
 
Application Threat Modeling In Risk Management
byMel Drews
 
Secure Iowa Oct 2016
byLarry Slobodzian
 
Web Security Overview
byNoah Jaehnert
 

More from Adam Englander

PPTX
Making PHP Smarter - Dutch PHP 2023.pptx
byAdam Englander
 
PDF
Practical API Security - PyCon 2019
byAdam Englander
 
PDF
ZendCon 2018 - Practical API Security
byAdam Englander
 
PDF
ZendCon 2018 - Cryptography in Depth
byAdam Englander
 
PDF
Dutch PHP 2018 - Cryptography for Beginners
byAdam Englander
 
PDF
php[tek] 2108 - Cryptography Advances in PHP 7.2
byAdam Englander
 
PDF
php[tek] 2018 - Biometrics, fantastic failure point of the future
byAdam Englander
 
PDF
Biometrics: Sexy, Secure and... Stupid - RSAC 2018
byAdam Englander
 
PPTX
Practical API Security - PyCon 2018
byAdam Englander
 
PDF
Practical API Security - Midwest PHP 2018
byAdam Englander
 
PDF
Cryptography for Beginners - Midwest PHP 2018
byAdam Englander
 
PDF
Cryptography for Beginners - Sunshine PHP 2018
byAdam Englander
 
PDF
ConFoo Vancouver 2017 - Biometrics: Fantastic Failure Point of the Future
byAdam Englander
 
PDF
Con Foo 2017 - Don't Loose Sleep - Secure Your REST
byAdam Englander
 
PDF
ZendCon 2017 - Cryptography for Beginners
byAdam Englander
 
PDF
ZendCon 2017: The Red Team is Coming
byAdam Englander
 
PDF
ZendCon 2017 - Build a Bot Workshop - Async Primer
byAdam Englander
 
PDF
Symfony Live San Franciso 2017 - BDD API Development with Symfony and Behat
byAdam Englander
 
PDF
Coder Cruise 2017 - The Red Team Is Coming
byAdam Englander
 
PDF
Don't Loose Sleep - Secure Your Rest - php[tek] 2017
byAdam Englander
 
Making PHP Smarter - Dutch PHP 2023.pptx
byAdam Englander
 
Practical API Security - PyCon 2019
byAdam Englander
 
ZendCon 2018 - Practical API Security
byAdam Englander
 
ZendCon 2018 - Cryptography in Depth
byAdam Englander
 
Dutch PHP 2018 - Cryptography for Beginners
byAdam Englander
 
php[tek] 2108 - Cryptography Advances in PHP 7.2
byAdam Englander
 
php[tek] 2018 - Biometrics, fantastic failure point of the future
byAdam Englander
 
Biometrics: Sexy, Secure and... Stupid - RSAC 2018
byAdam Englander
 
Practical API Security - PyCon 2018
byAdam Englander
 
Practical API Security - Midwest PHP 2018
byAdam Englander
 
Cryptography for Beginners - Midwest PHP 2018
byAdam Englander
 
Cryptography for Beginners - Sunshine PHP 2018
byAdam Englander
 
ConFoo Vancouver 2017 - Biometrics: Fantastic Failure Point of the Future
byAdam Englander
 
Con Foo 2017 - Don't Loose Sleep - Secure Your REST
byAdam Englander
 
ZendCon 2017 - Cryptography for Beginners
byAdam Englander
 
ZendCon 2017: The Red Team is Coming
byAdam Englander
 
ZendCon 2017 - Build a Bot Workshop - Async Primer
byAdam Englander
 
Symfony Live San Franciso 2017 - BDD API Development with Symfony and Behat
byAdam Englander
 
Coder Cruise 2017 - The Red Team Is Coming
byAdam Englander
 
Don't Loose Sleep - Secure Your Rest - php[tek] 2017
byAdam Englander
 

Recently uploaded

PDF
Decoding the DNA: The Digital Networks Act, the Open Internet, and IP interco...
byCSUC - Consorci de Serveis Universitaris de Catalunya
 
PDF
Top Cybersecurity Threats 2025 Guide by Sureshdas
byPrintersassist
 
PDF
Greetings All Students Update 3 by Mia Corp
by©LDMMIA, ©Reiki Yoga
 
PDF
The major tech developments for 2026 by Pluralsight, a research and training ...
byChris Skinner
 
PDF
Unlocking the Power of Salesforce Architecture: Frameworks for Effective Solu...
byvarsha30tiwari
 
PDF
API206-S: Transforming Supply Chains with Amazon Bedrock AgentCore - AWS re:I...
byChris Bingham
 
PPTX
Basics of Identity Access Management In mordern Infrastructure
byPrinceXavier18
 
PDF
Session 1 - Solving Semi-Structured Documents with Document Understanding
byDianaGray10
 
PDF
Incident Response Planning with a Foundation Model
byKim Hammar
 
PPTX
The Landscape of Computer Software Development Companies
byYash Singh
 
PDF
Agentic Automation for Testers – A Hands-On Deep Dive
byUiPathCommunity
 
PDF
Empowering Productivity with Clever Prompts and Intelligent Agents
byUni Systems S.M.S.A.
 
PDF
Generative AI in 2026: Hype, Bubble, Winter or The Real Deal?
byDr. Tathagat Varma
 
PDF
Generative AI in UiPath: Mastering the Generative Extractor for Intelligent D...
byDianaGray10
 
PDF
eResource Scheduler Enterprise Resource Management and Scheduling Software.pdf
byeResource Scheduler
 
PDF
Digit Expo 2025 - EICC Edinburgh 27th November
byRay Bugg
 
PDF
Vibe Coding vs. Spec-Driven Development [Free Meetup]
byHaim Michael
 
PDF
Knowing and Doing: Knowledge graphs, AI, and work
bymarainglezakis1
 
PDF
TrustArc Webinar - Assessing AI Risk with Confidence
byTrustArc
 
PDF
Usage Control for Process Discovery through a Trusted Execution Environment
byValerioGoretti
 
Decoding the DNA: The Digital Networks Act, the Open Internet, and IP interco...
byCSUC - Consorci de Serveis Universitaris de Catalunya
 
Top Cybersecurity Threats 2025 Guide by Sureshdas
byPrintersassist
 
Greetings All Students Update 3 by Mia Corp
by©LDMMIA, ©Reiki Yoga
 
The major tech developments for 2026 by Pluralsight, a research and training ...
byChris Skinner
 
Unlocking the Power of Salesforce Architecture: Frameworks for Effective Solu...
byvarsha30tiwari
 
API206-S: Transforming Supply Chains with Amazon Bedrock AgentCore - AWS re:I...
byChris Bingham
 
Basics of Identity Access Management In mordern Infrastructure
byPrinceXavier18
 
Session 1 - Solving Semi-Structured Documents with Document Understanding
byDianaGray10
 
Incident Response Planning with a Foundation Model
byKim Hammar
 
The Landscape of Computer Software Development Companies
byYash Singh
 
Agentic Automation for Testers – A Hands-On Deep Dive
byUiPathCommunity
 
Empowering Productivity with Clever Prompts and Intelligent Agents
byUni Systems S.M.S.A.
 
Generative AI in 2026: Hype, Bubble, Winter or The Real Deal?
byDr. Tathagat Varma
 
Generative AI in UiPath: Mastering the Generative Extractor for Intelligent D...
byDianaGray10
 
eResource Scheduler Enterprise Resource Management and Scheduling Software.pdf
byeResource Scheduler
 
Digit Expo 2025 - EICC Edinburgh 27th November
byRay Bugg
 
Vibe Coding vs. Spec-Driven Development [Free Meetup]
byHaim Michael
 
Knowing and Doing: Knowledge graphs, AI, and work
bymarainglezakis1
 
TrustArc Webinar - Assessing AI Risk with Confidence
byTrustArc
 
Usage Control for Process Discovery through a Trusted Execution Environment
byValerioGoretti
 
In this document
Powered by AI

Overview of threat modeling by Adam Englander, including its importance and outline.

Definition of threat modeling, emphasizing the identification and prioritization of potential threats.

Steps involved in threat modeling including documentation, asset identification, entry points, and dependencies.

Methods for identifying threats such as STRIDE and using attack trees along with risk quantification via DREAD.

Stages of threat mitigation including quick reductions and acceptable solutions for identified threats.

Example of an insider attack detailing actors, assets, attack trees, and phased mitigation strategies.

Immediate actions to take, incorporation into SDLC, and long-term improvement strategies for threat modeling.

Additional resources on threat modeling, including recommended readings and a Q&A session.

Threat Modeling for Dummies