The document discusses threat modeling in penetration testing from both business and attackers' perspectives, emphasizing the importance of identifying and mitigating potential threats to systems and assets. It provides insights into creating attacker profiles, threat catalogs, and determining where to focus security efforts. The author, Kharim Mchatta, shares personal experiences and methods used in threat modeling within the cybersecurity field.

1. THREAT
MODELLING
IN
PENETRATION
TESTING

2. Whoami?
❖ Kharim Mchatta
❖ CEO of HACK IT CONSULTANCY
❖ Cybersecurity professional (Pen tester & Digital Forensics expert)
❖ Founder of H4K-IT (Cybersec community inTZ)
❖ CTF player
❖ Blogger
❖ Author at eForensics and Pentets Magazine
❖ DW Swahili Subject matter expert (cybersecurity)

3. What is
Threat
Modelling

4. Threat
Modelling
From
Business
Perspective

5. Threat
Modelling
From
Business
Perspective
Hackers
PC Servers Applications
Firewall
Organization
PROTECTING
Threats
Threat Modelling from a business perspective is the process of
People
Assets
Virus/worms

6. BRUCE WAYNE/BATMAN THREAT MODEL
BATMAN’S ASSETS ATTACKERS
Batman Cave
Alfred
Email
Cell Phone
Police
Joker
Journalist
VECTOR’S
Low Risk
Med Risk
High Risk

7. BRUCE WAYNE/BATMAN THREAT MODEL
BATMAN’S ASSETS ATTACKERS
Batman Cave
Alfred
Email
Cell Phone
Police
Joker
Journalist
CONTROLS

8. Threat
Modelling
From
Attackers
Perspective

9. ASSETS ATTACKERS
ATTACKERS PERSPECTIVE
Hackers
Firewall
Server
Credentials
Admin Panel Hidden Directories
Databases

10. Mmmhh!!! I guess
this threat
modelling staff isn’t
bad after all

11. PERSONAL EXPERIENCE IN THREAT
MODELLING AS A NEWBIE
Kharim
Credentials
Internet Firewall
WordPress
Website
Admin Panel Backend
Access
Request goes
through
If not malicious
access
If malicious
Access denied
Successfully
Authenticated

12. PERSONAL EXPERIENCE IN THREAT
MODELLING AS AN EXPERIENCED NEWBIE
Kharim Internet
Firewall
WordPress
Website
Access Access
Check the technologies
Used by the application
Check for existence
Of anyWAF
Perform Manual
Enumeration
Admin Panel
If Present
Attacker may use
Tools for enumeration
Enumeration for
Credentials
If not Present

13. IMPORTANCE OF THREAT MODELLING
Determine where most effort should be applied on the system and
assets
Internet Banking
Bank Website
VS

14. Threat-modelling
methods uses
include.
• To create an abstraction of the system
• To create profiles of potential attackers, including their
goals and methods
• To create a catalogue of potential threats that may arise

15. THAT’S ALL FOLKS

16. Author: Kharim Mchatta
Contacts
Kharimhmchatta@gmail.com kharim.h mchatta
KMchatta