Threat Modeling

• By the end of this chapter, students will be able to:
  • Define core threat modeling terminology
  • Explain proactive vs reactive threat modeling
  • Apply STRIDE to identify threats
  • Understand threat modeling in modern systems (cloud, AI, supply chain)
  • Relate threat modeling to risk management and governance

• A risk is the possibility or likelihood that a threat will exploit a vulnerability resulting in a loss such as harm to an asset.
• Risk management attempts to reduce or eliminate vulnerabilities or reduce the impact of potential threats by implementing controls or countermeasures.
• Risk elements are:
  • Threat
  • Vulnerability
  • Asset
  • Damage

• Threat modeling can be performed as:
  • Proactively
    • During system design and development
    • So, Security is built in from the start
  • Reactively
    • After deployment or after incidents
    • Based on observed attacks or failures

1. System / Architecture-Focused
   • Focuses on system components, their interactions, and trust boundaries.
   • Looks at how threats exploit structural weaknesses, not just assets or software bugs.
   • Why it matters:
     • Modern systems are distributed (microservices, APIs, cloud services).
     • An attack on a weakly protected service can compromise the entire system.
   • Examples:
     • Exposed internal APIs in a cloud app allow data exfiltration.
     • Misconfigured firewall rules between containers lead to lateral movement.
     • IoT network segmentation not enforced, allowing attacker access to critical devices.

1. Data-Focused
   • Focuses on sensitive data, how it is stored, transmitted, or processed.
   • Data breaches are the most common impact of modern cyber incidents.
   • Protecting assets alone doesn t guarantee data security. ’
   • Examples:
     • Customer personal data stored unencrypted in a cloud database.
     • Logs containing PII sent over unsecured channels.
     • GDPR-regulated data processed by third-party SaaS without proper consent.

1. Supply Chain / Third-Party Focused
   • Focuses on vendors, libraries, APIs, and other external dependencies.
   • Attackers increasingly exploit weak links outside the organization.
   • Modern software relies on third-party packages or services.
   • Examples:
     • Compromised third-party software update used in corporate software.

1. Environment / Deployment-Focused
   • Looks at the environment where the system runs: cloud, on-prem, hybrid, containerized.
   • Includes configuration management, patching, and deployment pipelines.
   • Misconfigurations are a top attack vector in modern systems.
2. Emerging Technology Focus
   • AI-Powered Systems: Automated decision-making (Agentic-AI) can be exploited.
   • IoT / OT Systems: Sensors, actuators, or industrial control systems can be attacked physically or digitally.

Spoofing: gaining access through falsified identity

1.

Tampering: unauthorized changes or manipulation of data

2. 3.

Repudiation: Ability to deny having performed an action/activity

4.

Information disclosure: Revelation or distribution of private, confidential, or controlled information to unauthorized entities Denial of service (DoS): Prevent authorized use of a resource.

5.

This can be done through connection overloading or traffic flooding

6.

Elevation of privilege: A limited user account is transformed into an account with greater privileges, powers, and access.

Although STRIDE is typically used to focus on application threats, it is applicable to other situations, such as network threats Other attacks may be more specific to network, such as sniffing.

A

• SECURE SUPPLY CHAIN is one in which all of the vendors or links in the chain are reliable, trustworthy, reputable organizations that disclose their practices and security requirements to their business partners.
• The goal of a secure supply chain is:
  • to ensure that the finished product is of sufficient quality, meets performance and operational goals, and provides stated security mechanisms, and
  • that at no point in the process was any element counterfeited or subjected to unauthorized or malicious manipulation or sabotage.

CYS team should inspect the connected systems throughout:

• On-Site Assessment Visit the site of the organization to interview personnel and observe their operating habits.
• Document Exchange and Review Investigate the means by which datasets and documentation are exchanged as well as the formal processes by which they perform assessments and reviews.
• Process/Policy Review Request copies of their security policies, processes/procedures, and documentation of incidents and responses for review.
• Third-Party Audit Having an independent third-party auditor