What is threat modeling ❓ Definition, Methods, Example

Threat modeling process

  • Define safety requirements
  • Identify the likely threats
  • Threat Assessment
  • Mitigating Threats
  1. Nothing ought to be done (too generally safe or too hard to even consider conveying the related intimidation)
  2. Eliminate the usefulness that is connected to it.
  3. Diminish the convenience of the component or turn it off.
  4. Acquire new code, foundation, or plan upgrades.
  5. You’ll likewise monitor weaknesses that will be settled in ongoing releases
  • Confirmation of threat mitigation

Why is it important to do this?

What are the popular threat modeling techniques?

  • Stride threat model
  • PASTA threat modeling
  • Attack Trees
  • TRIKE threat model
  1. Make resource based danger profiles. (This is an assessment of the organization.)
  2. Decide the foundation’s weakness. (This is a glance at the information framework.)
  3. Set up a security methodology and plan. (Dangers to the association’s vital resources and direction are perceived.)
  • VAST
  • Persona non Grata
  • hTMM
  1. Figure out which framework will be danger demonstrated.
  2. Apply Safety Cards as per engineer advice.
  3. PnGs that are probably not going to happen ought to be taken out (i.e., there are no sensible assault vectors).
  4. Make a synopsis of the discoveries with the assistance of the device.
  5. Keep on utilizing a conventional course of hazard evaluation.
  • qTMM

Benefits of Threat Modeling

  • Find issues from the get-go in the product advancement life cycle (SDLC)- even before any coding happens.
  • Distinguish configuration gives that standard testing and code audits could miss.
  • Analyze new sorts of assault that you probably won’t have considered previously.
  • Assisting with focusing on testing and code audit can assist you with taking advantage of your testing financial plan.
  • Decide the security necessities.
  • Forestall exorbitant post-arrangement recoding by settling issues before programming is delivered.
  • Think about risks other than ordinary attacks, like security weaknesses explicit to your application.
  • Keep systems in front of the inner and outside aggressors who might be a danger to your applications.
  • To sort out what parts aggressors will target, feature resources, danger specialists, and controls.
  • To find potential assailants in association with the framework engineering, model the situation of danger specialists, intentions, abilities, and capacities.

Threat modeling tools





CEO at Wallarm. Application security platform to prevent threats and discover vulnerabilities in a real-time.

Love podcasts or audiobooks? Learn on the go with our new app.

Recommended from Medium

Engaging in Inclusive Practices Online: A Netiquette Microstudy

What is IAM (Identity and Access Management) ❓

Hiring a hacker on the Dark Web is just like paying for any other service

SkyID: How to Make Decentralized Identity using Skynet

Why the Okta breach is a sign of things to come

Top 10 Winners of BTFS Storage Space Mining Competition on August 17

Secrets Management Stinks, Use Some SOPS!

Amazon//custome//care//number 07898630099//9651068988//As a security conscious user who follows the…

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Ivan Novikov

Ivan Novikov

CEO at Wallarm. Application security platform to prevent threats and discover vulnerabilities in a real-time.

More from Medium

Kasm Workspaces Hacking Lab?

Using xdotool and shell scripts to automate keystrokes and randomise GatherTown avatar movements

Top 5 API Testing Methods to Secure Your Data

SecDevOps — not DevSecOps!