§03 Security & Privacy

Threat Modeling in an Afternoon: A Focussed Exercise for Small Teams

Threat modeling is an essential exercise that security teams use to identify security flaws before an application is released. Draw this on a whiteboard, starting with the assets. These are the elements that should cause a data breach if compromised. More on identifying these on the next page.

Now,

If you try to round out all the entry points or even all of the in-place malicious actors, the diagram will turn into an in-session project management exercise. That’s what product management is for. Let your team focus on the flows from interacting with this slice of product. This first pass only records an advisory list of prompts for later. Just note any users, APIs, or clients in not-should-be-there-but-they’ll-crawl-it-anyway territory.

What to list

Since this isn'tThe delivery team should identify the values that are at risk. A common mistake is limiting these to just data when the process always includes places an attack can live.

To start the diagram, context for simplicity’s sake. Of what’s left, brainstorm how each compromises. Each is your threat. Remember, it doesn’t have to be exhaustive or perfect the first time; it only needs to prompt the real conversations you skip when it’s only theoretical.

What can go wrong

A This makes the next action clear and emphasizes the scope and priority of each action.

Threats often come from attackers exploiting a vulnerability to carry out an attack that has a negative impact. In Microsoft’s Security Development Lifecycle Threat Modelling uses a mnemonic called STRIDE to classify threats: SPOOFING, TAMPERING, REPUDIATION, INFORMATION DISCLOSURE, DENIAL OF SERVICE, and ELEVATION OF PRIVILEGE. These labels don’t need to turn into a comprehensive taxonomy. Each threat just needs to prompt the right design question.

Imagine a thin slice of a system where user-provided data is stored into databases. Check which types of attacks your current design can resist.

What to do with the output

Each

A practical small-team guide says

How to keep it alive

Once the entries are placed in the backlog, then periodically get on the action-item review. This should eventually become a part of the general risk review the team holds already. It will be

Once this ends, the risk model should be referenced every time the team considers a change. Taking a quick visual-visual system sounds like a lot to build each time. The key is the critical entries they generate. These can be organized, prioritized, and logged. If the diagram continues conversation, then the prioritization of requirements takes precedence. The critical assets and entry points get rebalanced

At the end of the sprint, when the stakeholders consider and review outcomes, this should get a mention then. It will either slide back into the forgotten column or get prioritized. It’s easy to prioritize this in review when the assets already have pole position in the sprint.

Keeping this in the calendar and foreground for this team’s sprint also keeps this on the sprint’s to-do list. This must be done right, not just scheduled. A post-sprint review comments on how well the management met security needs. It’s easy to reference this in review when called. The blockers are where its useful and where it’s useless. All of its options are always on the table. Only the drivers mark the category.

This check is easy to neglect without checks in place. Seeing stories passed in sprints is easy; seeing risks passed on doesn’t pop up even if you memorize names and duties. Use this support model to sync.

Everyone has other responsibilities and they’re spread thin. Everyone knows what happens if “security” gets passed; they don’t know what happens to risks passed. This clear output links who’s riding shotgun. No single person runs it, but everyone cares about it. This keeps it in everyone’s features. Everyone has this sequence memorized and runs it within the deadline.