Model-Based Threat Analysis
It used to be that most systems were isolated and disconnected; the only way to attack such a system required physical presence. Those days are long gone.
These days, most systems are internet-enabled and connected via apps to cloud-based servers and social media. This presents opportunities to attack these systems, compromise their security, violate their privacy, steal their information, and cause damage through malicious software.
Unfortunately, little has been done to protect systems in a systematic fashion. The most common response I hear when consulting is “Security. Yeah, I need me some of that,” and the issue is ignored thereafter. Sometimes, some thought is given to applying security tests ex post facto, or perhaps doing some code scans for software vulnerabilities, but very little is done to methodically analyze a system from a cyber-physical security posture standpoint. This recipe addresses that specific need.