Threat modeling : Being ready for the attackers

By


Threat modeling is an essauntial component of your Information security management system (ISMS). It aims to identify, analyse, plan, communicate, potential threats to protect assets in your network. It is basically,  getting into the attackers' head, and deploying effective defences against their Tactics, Tools, and Procedures (TTPs) . Threat modelling requires effective threat intelligence process to protect your organization from emerging cyber security threats. 

There are several threat modeling approaches such as PASTA, OCTAVE,  VAST, and STRIDE. The particular model applicable for your organization depends on the type of business, assets and threats. Threat modelling is based on your organization's infirmation security objectives and risk assesment outcomes as well as monitoring of indicators of compromises (IOCs). It also need to consider future and potential threats identified by your threat intelligence activities.

The generic steps of threat modelling recommended by are as follows:  

  •  Assessment Scope: identify assets potential for the threat.  
  •  Threat Agents and Attacks: Identify the groups of adverseries. This include insiders and outsiders, performing both accidental mistakes, malicious attacks leading to data leaks or other compromises.
  •  Identify exploitable vulnerabilities: Analyse potential vulnerabilities conducting, vulnerability scanning and penintration tests.  
  •  Prioritized identified risks: Prioritization is essential in threat modeling. Asses your risks with  likelyhood of occurence and impact factors to  determine an overall risk. 
  • Identify the Countermeasures: These measures are technical, physical and administrative controls identified through your risk management process.  
  •  Develop a plans to reduce threats: Create a plan to implement identified controls to reduce the risk to acceptable levels. 
  •  Implement Controls : Implement the identified controls, train your staff, monitor and measure effectiveness of controls using defined Key Performance Indicators (KPI)

Threat modeling should cover every possible entry point to your network, interfaces to applications, internal systems, cloud systems, Internet of Things (IoT) devices, and exposed business processes.

A threat model typically includes:

  • Information assets used by business functions 
  • KNOWN threat landscape for each asset 
  • Types of adverseries to be modeled
  • Tactics, Tools and Procedures (TTPs) used by adverseries 
  • Potential threats and known Vulnerabilities
  • Means of mitigation or security controls 
  • A way of validating the model by testing of vulnerabilities 
  • Means of monitoring, verification and measuring of controls

In abstract, threat modeling is a process to capture, organize, analyze, and prioritize all threats to information assets in organization, to apply necessary security controls for the mitigation of threats to reduce risk levels, and monitor their effectiveness.  

Threat Modeling is a cyclic process, which becomes more and more granular throughout it's lifecycle. It gets inputs from threat intelligence of new attack vectors, organization changes, and IoCs which require identification, analysis and addressing of threats. 

The threat model  should be updated when:

For applications:

  • A new feature is released
  • Security incident occurs
  • Architectural or infrastructure changes
  • When operating environment changes

For Networks :

  • When network configurations changes
  • When networks expands or infratructure changes 
  • When interfearing with another network (mergers)

Threat modelling is a critical function to ensure information security of your organization. It is an ongoing process sensitive to business, infrastructure and environmental changes. Threat modelling should be based on continues risk assesment and threat intelligence.

Niranjan Meegammana 


Comments

Post a Comment

Popular posts from this blog

The 7 Layers of Cyber Security : Attacks on OSI model

By
Image
Source : wallarm The OSI network  communications model is made of  7 layers. Each layer  handles a specific process to enable reliable communication between two or more devices. When the Internet was designed, its focus was on ensuring of reliable communications. The challenges of communication security emerged later.  These 7 layers act like a chain of links. If one lnk breaks, the whole chain of communication breaks. Hence security threat can happen at any of the 7 layers.  These layers are named as Application, Presentation, Session, Transport, Network, Data link and Physical layer. The application layer is your email application, physical layer is your communication cable, and everything else is in between help you communicate. In abstract the application layer provides user interface, while presentation layer handle formating, encoding and encryption. The session layer manages connections. The transport layer handles segmentation, sequencing, and establishi...
Read more

Best Practices for secure Software Development

By
Image
image : OpenSense Labs Are you aware of the  Solarwinds attack in 2020? The hackers exploited software vulnerabilities of Orion IT monitoring and management software used by thousands of enterprises and government agencies. This hack triggered a larger scale supply chain incident which affected thousands of organizations, including the U.S. government. The attackers infliltrated the Solarwinds network, and infected the software used for Network monitoring before it shipped to customers.This insident and many more warn us on the importance of building secure software.  Secure software development is a methodology used for creating robust software by incorporating security practices into every stage of the software development life cycle (SDLC). It begins at planning stage before a single line of code is written, and continue through the life cycle. A bug fixing at implementation stage cost six times than fixing it during design stage. Every new feature added, may carry series o...
Read more

ISO 27001 ISMS in a Nutshell

By
Image
Image : ISO The ISO 27001 certification is the most comprehensive  information security standard recognized globally. It ensures standardizing of your organisation's information security strategies to ensure confidentiality, integrity and availability of your systems and data to conduct your business effectively.  Gaining the certification is a journey with several milestones. It is a carefully planned systematic activity that transforms an organisation to a secure entity,  where everyone becomes a stakeholder in information security. Follow this processes to get to your goal successfully. Step 1. Obtain Management Support . This is the most critical requirement to achieve ISO 27001 status. Your ISMS project will definitely fail if it does not receive to management support. The management should provide, people, money and strategic direction for your ISMS to be a success story. In the sections below you’ll find some tips on how to convince your management, and how much th...
Read more