What is Threat Modeling and How Do You Learn It?

Have you ever watched a movie where the good guys had to 'get into the mind' of the bad guys in order to figure out how to stop them? What if we told you that security engineers do the exact same thing when they perform Threat Modeling?

Look, it's not like threat modeling is like Minority Report or anything, so don't get too excited. But it's still an incredible way to gain insight into the exploitability of your apps. When you know how to break into your own app, you automatically get the blueprints that will help you patch up those security flaws.

In this article, we're going to look at what threat modeling even is, different types of threat modeling methodologies, and courses where you can learn to perform threat modeling.

What is Threat Modeling?

When an attacker attempts to break into your application, here is what they're trying to do:

• Survey or scan the target application to find weaknesses in the design or structure.
• Once they find a security flaw, they will try to exploit it using various offensive methods.
• They'll most likely use the most serious vulnerability first, because those are the easiest to exploit.
• If the exploit is successful, they will be able to access, and even modify or steal confidential data.

This—broadly speaking—is how a cybersecurity attack goes. When you're performing a threat modeling exercise on your app, you're essentially repeating the exact same steps (without all the illegal bits, of course). According to OWASP, most threat modeling methodologies need to ask (and ultimately answer) 4 fundamental questions about your application:

1. What are we building?

Threat modeling is usually done at the very start of building the application, while it's still in the design phase. This is the point where you understand what kind of app you're developing. For example, what kind of architecture are you building on (cloud native, containerised, serverless)? What kind of resources, database, or workflows will you be using.

By asking detailed questions like this, you're not only eliminating ambiguities in the design of your software, but making it easier to formulate a security strategy later on.

2. What can go wrong?

This is where it gets really interesting. Once you know what kind of app you're building, you'll need to figure out what specific weaknesses an attacker can exploit in order to break your app. This process involves identifying security controls, modelling attack possibilities, and locating threat agents that will be the main source of your security problems.

3. What are we going to do about that?

Once you know where your application is vulnerable, it's time to figure out how to build security measures to protect it. You'll need to determine the sort of countermeasures and mitigations to employ against the biggest security weaknesses that pose a threat to your app.

4. Did we do a good enough job?

This is a retrospective stage, where you go over the threat model you've developed and check for things like quality, feasibility, progress and planning.

Note: There's a common misconception that threat modeling and pentesting are similar or the same. Just to be clear, they are totally different security activities that serve different purposes. Penetration testing helps you find bugs and vulnerabilities in your application's code. Threat modeling helps you find vulnerabilities and flaws in the design of your app.

Types of Threat Modeling: Top 5 Methodologies

There are several types of threat modeling you can apply  your software, many of them with goofy-sounding acronyms. Threat modeling needs to follow a set structure or approach to be effective, which is why AppSec professionals have developed methodologies to follow. While there are a lot more of them out there, we'll talk about the 5 most popular ones here.

1. STRIDE

STRIDE has been described as the granddaddy of threat modeling. It was developed by Microsoft way back in the '90s, and has become the most popular methodology ever since. The letters in STRIDE stand for the different types of security threats it helps you find:

• Spoofing — impersonating another person or computer
• Tampering — modifying private/confidential data or code
• Repudiation — not logging or monitoring threat events
• Information disclosure — leaking or exposing data
• Denial of Service (DoS) — overloading services with traffic to make it crash or prevent actual use
• Privilege escalation — attackers granting themselves higher privilege and access unauthorised data

2. PASTA

PASTA stands for Process for Attack Simulation and Threat Analysis (told you they had goofy acronyms). It's a 7-step process that is meant to correlate business objectives with technical requirements. Here are the 7 steps involved in threat modeling with PASTA:

• Define objectives
• Define technical scope
• Application decomposition
• Threat analysis
• Vulnerability and weaknesses analysis
• Attack modelling
• Risk and impact analysis

3. VAST

VAST stands for Visual, Agile Threat Modeling, and as the name suggests, this methodology was developed specifically for workflows incorporating the DevOps philosophy. The idea behind VAST is that the threat modeling process can only be effective when it's scaled across the infrastructure and integrated with Agile development environments. This will ensure that the threat model is viable and useful for developers, security engineers, and senior executives.

4. Trike

Trike threat modeling stands in contrast with most other methodologies in that, rather than trying to emulate the attacker and their techniques, you're instead taking a defensive approach. Trike has you modelling the target app or system, enumerating the threats, assigning the appropriate risk values, and then apply mitigating controls to address the most serious threats.

It's both a framework and an open-source tool, which you can find here.

5. OCTAVE

OCTAVE stands for Operationally Critical Threat, Asset, and Vulnerability Evaluation, and it was developed at the Carnegie Mellon University. This methodology focuses more on security risks at an organisational rather than technological level. OCTAVE helps organisations identify data assets most at risk, and direct them to implement more robust security measures across their information assets. OCTAVE has 3 phases:

• Build asset-based threat profiles
• Identify infrastructure vulnerability
• Develop a security strategy and plans

Why is Threat Modeling important? Should you learn it?

Threat modeling, unlike a lot of traditional security testing methods, looks at flaws and vulnerabilities in the design of your apps rather than the code itself. It's one of the most reliable ways to document the various components of a system and understand why they are at risk.

But perhaps even more importantly, threat modeling is a really effective way to get to know how your application works at a very granular level.

"The message on threat modeling actually isn't for the security teams," says Dinis Cruz, CISO of Glasswall. "I view threat modeling as a technique to document and to create a real-world view of the application. One of the side-effects of this is [identifying] the security risks, but the most important objective is [understanding] how the thing works."

You can watch our full interview with Dinis Cruz on the AppSecEngineer Youtube channel.

Threat modeling is a great way to identify and document problems with your application at a very early stage in the SDLC, often even before the coding begins. It also lets you know the security requirements of your software early on so you can prioritise the most important tasks that need immediate attention.

A detailed, well-documented threat model also helps you think beyond standard attacks to scenarios unique to your application.

Threat Modeling courses you can take

There a few options if you want to learn threat modeling for for free. Microsoft has a'Threat Modeling Security Fundamentals'learning path where you can go through short documents that take you step-by-step through the process of basic threat modeling.

Martin Fowler also has a very in-depth Guide to Threat Modelling for Developers, which is a detailed, dev-focused blog post on how to get started with threat modeling.

But this is one of those things where you can't really learn threat modeling without doing it yourself. You'd need to get hands-on with the process if you want to understand how it really works. After all, how you threat model one app won't be how you do another.

That's why AppSecEngineer offers two full-fledged courses on threat modeling. We cover all practical aspects of the process with detailed videos, and reinforce it with hands-on labs where you can practice what you've learnt. They're intuitive, easy to follow, and are by far the most effective way to learn threat modeling.

You can find both courses on our Threat Modeling Learning Path.