1) What is Threat Modeling?
Threat modeling is a way to think ahead about possible problems, what could go wrong, in your systems, applications, or infrastructure so you can build the right defenses before anyone attacks. Instead of waiting for something bad to happen, you look for weak spots early on, figure out how someone might break in, what they might go after, and what the damage could be. Then you come up with good solutions. At its core, it's a method that helps you find, measure, and deal with security threats across an organization. NIST (SP 800-30) says it's a key part of managing risk because it helps businesses decide which security steps to take, where to put resources, and how to use them properly. What started as basic checks for weaknesses has now become full frameworks that cover the whole picture of possible threats. As cyberattacks get more complex, the need for threat modeling has grown. CISA says that finding risks early lets organizations set up protections just in time, instead of fixing things after an attack happens. Another benefit is that it helps security teams think like hackers, looking at systems from the perspective of someone trying to break in and finding paths they might not have noticed. It's also a big part of managing risk in large companies, making sure security efforts match the business goals. Importantly, threat modeling knows there's no single solution that works for everyone. Every business has different risks based on its industry, where it's based, the technology it uses, and how it makes money.
2) How is Threat Modeling Different from Threat Hunting?
While threat modeling is about looking ahead, anticipating what could go wrong during the design and development of systems, threat hunting is about looking inside your live environment to find signs of attackers who may already be active.
- Goal: Threat modeling aims to design systems securely before attacks happen. On the other hand, threat hunting seeks to detect stealthy attackers already inside the network.
- Timing: Threat modeling is proactive and used during design, planning, and development. Threat hunting is reactive and continuous, used during operations and monitoring.
- Focus: Threat modeling looks at assets, architecture, and potential attack paths. Threat hunting focuses on abnormal activity, attacker behaviors, and indicators of compromise.
- Outcome: Modeling produces better designs and preventive controls. Hunting produces detection, investigation, and faster incident response.
3) Two Main Approaches: The philosophy behind a threat modeling initiative typically falls into one of two categories, each with distinct advantages and implications.
Defensive Approach:
The defensive approach is about finding and dealing with possible threats before they turn into real problems. This is the usual way of thinking about threats and is closely linked to modern threat modeling. It means building security into systems from the start, not adding it later. This method is used during the planning and making of any project. The main idea is to build security early on and use it all through the Software Development Life Cycle (SDLC) to help with how the system is designed, what features are needed, how it's tested, and when it's ready to be released. It focuses on solving problems that could let hackers get in before the code is finished.
Reactive Approach:
Even with all the steps taken to stay ahead of possible dangers, it's still hard to catch every threat before it happens. That's why it's important to have plans in place that respond to threats once they're already happening. One such method is called threat hunting. This involves looking closely at systems after they've been set up to spot any signs that something bad might have already taken place. These signs are often called Indicators of Compromise, or IoCs. Threat hunting helps find problems after they occur, which is different from defensive threat modeling, which aims to stop issues before they start.
4) Steps Involved in Threat Modeling
1) Identify Assets:
Figure out which assets need to be protected, like data, systems, apps, and physical infrastructure.
- Make a list of all the assets.
- Sort them by how important and sensitive they are.
- Find out how much each asset is worth to the company.
2) Create an Architecture Overview:
Make a big picture view of your netwrok digram, system setup and connectivity, how they are linked, showing how data moves and how different parts connect.
- Draw a picture of the system to show where data goes.
- List the main parts, like databases, servers, and network areas.
- Show connections with outside systems and services.
3) Identify Threats:
Find out what possible threat could harm the security of the system. These might come from outside people, inside workers, bad access, or outside partners.
- Use guides and tools like STRIDE to find possible risks.
- Talk with people in charge and security experts to think through possible dangers.
- Look at threats from different angles, like what a hacker might try or what motives they might have.
4) Identify Vulnerabilities:
Find weaknesses in the system that bad people might use to cause harm. These weaknesses can be things like software that hasn't been fixed, settings that are set up wrong, or passwords that are too simple.
- Check for weaknesses using tests and tools.
- Look at past problems and weaknesses in similar systems.
- Use both automatic tools and manual checks to find security issues.
5) Determine Attack Vectors:
Figure out how an attacker could use each weakness. Ways attackers might try to take advantage include fake emails, harmful software, repeated login attempts, tricking people, and other methods. Look at how bad each threat and weakness could be and how likely they are to happen.
6) Assess Risks:
Architecture reviews, abuse-case tests, and observability checks confirm effectiveness.
Activities:- Review risks to decide which threats are most important based on how bad they could be and how likely they are.
- Use both general and specific ways to understand the risks.
- Write down the results of your risk check and sort the threats by how serious they are.
7) Prioritize Attacks:
Focus on the biggest and most likely threats first and pay attention to the ones that could cause the most problems for your company.
8) Create Attack Scenarios:
For each important attack, come up with a clear plan that shows how the attack could happen. Talk about the steps an attacker might follow to use weaknesses and get into a system without permission.
9) Diagram Attack Paths:
Make pictures that show how an attack moves through a system. Use charts or drawings to show each part of the attack plan, like where the attacker starts, how they move through the system, how they take data out, and any other important steps.
10) Determine Countermeasures and Mitigations:
: Find out what risks exist, create plans to lower or remove them, and put those plans into action.
Activities:- Make and use security features like keeping data safe with codes, limiting who can access things, and watching for unwanted activity.
- Check again to make sure these safety steps are working well against the dangers.
- Update the list of possible threats to show how things have changed and improved.
11) Validate and Verify:
Make sure the process of looking for threats and the safety steps are working as they should.
Activities:- Test the security by trying to break into the system and checking the code for problems.
- Keep checking and reviewing the threat list regularly.
- Make sure all the found dangers and weak spots have been properly fixed.
12) Document and Communicate:
Write down the whole process of threat modeling and share the results and what's been done with the right people.
Activities:- Make clear reports that explain the threats, weaknesses, dangers, and ways to fix them.
- Tell the results to the people who need to know, like leaders, IT staff, and security teams.
- Keep talking and updating everyone so they know how secure the system is all the time.
13) Monitor and Review:
Keep an eye on the system for new dangers and weaknesses, and change the threat model when needed.
Activities:- Set up a way to find new threats and weaknesses quickly.
- Check and update the threat model often to match any changes in the system or surroundings.
- Do regular check-ups and threat modeling again to stay prepared.
5) Several different approaches to categorize and analyze these threats
Focused on Assets:
In this method, you begin by looking at the value of the resources that the organization has, like data, intellectual property, or physical structures. Once you figure out what these resources are and how valuable they are, you then look into the possible dangers they might face.
Focused on Attacker:
If a company works in a risky area, like banking or government, it might face attacks from nation-states, criminals, or groups with political goals. The company can look into the ways these attackers might try to harm them, such as through fake emails (Scammers), stealing data for money (Ransomeware), or targeted attacks.
Focused on Software:
If a company makes software, it pays attention to possible dangers that could affect the software. This includes looking at weaknesses in the code, like errors in the program logic, unsafe ways to connect to the internet, or old parts of the code that are no longer supported.
6) Frameworks & Methods to Lean On
NIST & ISO:
- NIST SP 800-30 — risk assessment (likelihood × impact)
- NIST SP 800-154 — data-centric threat modeling
- ISO/IEC 27005 — IS risk management within an ISMS
ISACA / COBIT & (ISC)²:
- COBIT — governance hooks, roles, metrics
- ISACA guidance — integrating modeling into enterprise risk
- (ISC)² CBK — shared terminology for cross-teams
SANS, EC-Council, CISA:
- SANS: practitioner playbooks & IR loop
- EC-Council: STRIDE, PASTA, OCTAVE, DREAD, TRIKE, VAST
- CISA: Secure-by-Design / Default expectations