Threat Modeling

Appendix A. A Worked Example

We believe that we have given you a deep understanding of the process of threat modeling from building a system model, eliciting information about the system, and analyzing the abstraction for potential vulnerabilities and threats. Here, we walk you through an example in order to solidify your understanding.

Note

Since this is a static document that lacks the level of interactivity threat modeling usually requires, the following process steps are condensed to “set the stage” followed by “giving away the ending” (no spoilers here!). From this approach, you should glean how you might approach your own threat modeling exercise based on whichever methodology you may choose.

High-Level Process Steps

As a reminder from Chapter 2, here are the high-level threat modeling steps that we will follow in this sample:

1. Identify objects in the system under consideration.

2. Identify flows between those objects.

3. Identify assets of interest.

4. Determine the potential for impact on assets.

5. Identify threats.

6. Determine exploitability.

Following identification of threats would be filing defects, working out mitigations, and coordinating with the system development teams to get mitigations in place; we won’t go into these steps in this sample, as that is organization-specific and we are not trying to change those aspects of your team (especially if those things work reasonably well for you now).

Approaching Your First System Model

The basic process for modeling ...